Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/07/2026, 17:51
General
- Target Quasarr-win-Setup (1).exe
- Size 40.5MB
- Sample260719-wfd2baax31
- SHA256 f942503dc3f1d37801897fc3ff2259645f33416f736138463dba033d6c3dff00
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 18 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quasarr-win-Setup (1).exe"C:\Users\Admin\AppData\Local\Temp\Quasarr-win-Setup (1).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Quasarr\current\Quasarr.exe"C:\Users\Admin\AppData\Local\Quasarr\current\Quasarr.exe" --veloapp-install 0.9.222⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Quasarr\current\Quasarr.exe"C:\Users\Admin\AppData\Local\Quasarr\current\Quasarr.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Avalonia.Base.dll
Avalonia.Controls.dll
CommunityToolkit.Mvvm.dll
MediatR.dll
Microsoft.EntityFrameworkCore.dll
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Extensions.DependencyInjection.dll
Microsoft.Extensions.Logging.Abstractions.dll
Microsoft.Extensions.Logging.dll
Microsoft.Win32.Registry.dll
NuGet.Versioning.dll
Quasarr.deps.json
Quasarr.dll
Quasarr.exe
Quasarr.runtimeconfig.json
Serilog.Sinks.Async.dll
Serilog.Sinks.Console.dll
Serilog.dll
ShadUI.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.dll
System.Console.dll
System.Diagnostics.DiagnosticSource.dll
System.Diagnostics.Process.dll
System.IO.Compression.Native.dll
System.IO.Compression.dll
System.Linq.dll
System.ObjectModel.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Private.Xml.Linq.dll
System.Private.Xml.dll
System.Runtime.Numerics.dll
System.Runtime.dll
System.Security.AccessControl.dll
System.Security.Cryptography.dll
System.Threading.ThreadPool.dll
System.Threading.dll
Velopack.dll
clrjit.dll
coreclr.dll
hostfxr.dll
hostpolicy.dll
netstandard.dll
sq.version
Quasarr-0.9.22-full.nupkg
velopack.log