Analysis
- max time kernel
60s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/07/2026, 02:14
General
- Target messenger_update.exe
- Size 3.1MB
- Sample260724-cpffys1elc
- SHA256 dbdf6c3c23d7b4981b50627e309a991a4c761c255b353bcdec54fcc3fa69799f
Malware Config
Extracted
-
quasar
-
1.4.1
-
pingping
-
zenlaw.io
-
malware.zenlaw.io
-
dff4d9d4-ee98-4856-b36f-7b3aeffd8d10
-
encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
-
install_name
molliza.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
5000
-
startup_key
malware
-
subdirectory
malware
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Executes a command shell one-liner 1 TTPs 18 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nIkja7br0aHA.bat" "2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LMvBW2LqPB7k.bat" "4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4pQWokCgFnC0.bat" "6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wvw3Aum9U9PD.bat" "8⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sS7BIn4buy79.bat" "10⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"11⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6OBxNZH6OQKe.bat" "12⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cJpVIIpuyfYZ.bat" "14⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C2GkpDlHK439.bat" "16⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FOeJaeJWzkxy.bat" "18⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q5x7dSUGrbd4.bat" "20⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HsQEOTk3dOpV.bat" "22⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7qTgrqk7sOh8.bat" "24⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RtQpyRyT2U5G.bat" "26⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xKJazAB6aGlM.bat" "28⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kHKHkhyxeSO1.bat" "30⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"31⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BsFIp0IiUcXM.bat" "32⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500133⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"33⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nKzwaxNGLSXI.bat" "34⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500135⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"35⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CHBPDpvRGNYR.bat" "36⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"37⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4pQWokCgFnC0.bat
6OBxNZH6OQKe.bat
7qTgrqk7sOh8.bat
BsFIp0IiUcXM.bat
C2GkpDlHK439.bat
CHBPDpvRGNYR.bat
FOeJaeJWzkxy.bat
HsQEOTk3dOpV.bat
LMvBW2LqPB7k.bat
RtQpyRyT2U5G.bat
cJpVIIpuyfYZ.bat
kHKHkhyxeSO1.bat
nIkja7br0aHA.bat
nKzwaxNGLSXI.bat
q5x7dSUGrbd4.bat
sS7BIn4buy79.bat
wvw3Aum9U9PD.bat
xKJazAB6aGlM.bat
memory/1144-30-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-23-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-26-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-27-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-28-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-29-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-25-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-31-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-32-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-33-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-34-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-35-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-36-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-24-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1144-43-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-8-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-7-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-14-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-13-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-12-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-11-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-21-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-10-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-0-0x00007FFE9769F000-0x00007FFE976A0000-memory.dmp
memory/1936-9-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-6-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-5-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-4-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-3-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-2-0x00007FFE97510000-0x00007FFE97EB4000-memory.dmp
memory/1936-1-0x00000000003B0000-0x00000000006DC000-memory.dmp