Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 16:28
General
- Target fix-rb.exe
- Size 952KB
- Sample260804-typjnadf33
- SHA256 f82f0195bd493f29fa2234f17674679cd86ccafcde3dc3d2fe118181ad6bf5d9
Malware Config
Extracted
-
quasar
-
encryption_key
33A7029011B6BD4B067B8907EB238F25EFF233BF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 19 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fix-rb.exe"C:\Users\Admin\AppData\Local\Temp\fix-rb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SystemHelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemHelper.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SubDir\SystemHelper.exe"C:\Windows\system32\SubDir\SystemHelper.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SystemHelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemHelper.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\SubDir\SystemHelper.exeC:\Windows\system32\SubDir\SystemHelper.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SystemHelper.exe
memory/1960-11-0x0000024404F80000-0x0000024404FB4000-memory.dmp
memory/3216-21-0x0000023723E20000-0x0000023723E2A000-memory.dmp
memory/3216-44-0x00000237250B0000-0x00000237250EA000-memory.dmp
memory/3216-9-0x0000023723EF0000-0x0000023723F00000-memory.dmp
memory/3216-51-0x0000023725150000-0x0000023725164000-memory.dmp
memory/3216-13-0x0000023723E40000-0x0000023723E52000-memory.dmp
memory/3216-14-0x0000023723EA0000-0x0000023723EDC000-memory.dmp
memory/3216-15-0x0000023724BC0000-0x0000023724BF8000-memory.dmp
memory/3216-16-0x0000023723DA0000-0x0000023723DAA000-memory.dmp
memory/3216-17-0x0000023723E60000-0x0000023723E86000-memory.dmp
memory/3216-18-0x0000023723E90000-0x0000023723E98000-memory.dmp
memory/3216-19-0x0000023724C00000-0x0000023724C62000-memory.dmp
memory/3216-20-0x0000023724C90000-0x0000023724CD2000-memory.dmp
memory/3216-49-0x0000023725120000-0x0000023725152000-memory.dmp
memory/3216-22-0x0000023723E30000-0x0000023723E3A000-memory.dmp
memory/3216-50-0x0000023724F50000-0x0000023724F60000-memory.dmp
memory/3216-39-0x0000023724F90000-0x0000023724FDA000-memory.dmp
memory/3216-23-0x0000023724F00000-0x0000023724F1A000-memory.dmp
memory/3216-40-0x0000023724FE0000-0x000002372502C000-memory.dmp
memory/3216-45-0x0000023724C70000-0x0000023724C7A000-memory.dmp
memory/3216-24-0x0000023724F60000-0x0000023724F82000-memory.dmp
memory/3216-43-0x0000023723EE0000-0x0000023723EF4000-memory.dmp
memory/3216-42-0x0000023724F20000-0x0000023724F4A000-memory.dmp
memory/3216-41-0x0000023725030000-0x00000237250B0000-memory.dmp
memory/3216-46-0x0000023724EE0000-0x0000023724EEC000-memory.dmp
memory/3216-48-0x00000237250F0000-0x0000023725124000-memory.dmp
memory/3216-47-0x0000023724EF0000-0x0000023724F06000-memory.dmp
memory/5008-2-0x000002345BFF0000-0x000002345C024000-memory.dmp
memory/5008-0-0x000002345A1E0000-0x000002345A2D4000-memory.dmp
memory/5008-1-0x000002345C0C0000-0x000002345C0D0000-memory.dmp