Analysis
- geolocation tags
- user interaction
yes - max time kernel
898s - max time network
896s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 04:26
General
- Target SYSWOW64.exe
- Size 955KB
- Sample260806-e2hsysshrb
- SHA256 ef74d1c29ee00f4ebc57c52426c2ac194a34f8f0c150443e95fc1d4f2a13403b
Malware Config
Extracted
-
quasar
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SYSWOW64.exe"C:\Users\Admin\AppData\Local\Temp\SYSWOW64.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4232-0-0x000001FB82E10000-0x000001FB82F04000-memory.dmp
memory/4232-1-0x000001FB832F0000-0x000001FB83300000-memory.dmp
memory/4232-2-0x000001FB832B0000-0x000001FB832E4000-memory.dmp
memory/4232-3-0x000001FB84D50000-0x000001FB84D62000-memory.dmp
memory/4232-4-0x000001FB9E270000-0x000001FB9E2AC000-memory.dmp
memory/4232-5-0x000001FB9E2B0000-0x000001FB9E2E8000-memory.dmp
memory/4232-6-0x000001FB84C10000-0x000001FB84C1A000-memory.dmp
memory/4232-7-0x000001FB84D70000-0x000001FB84D96000-memory.dmp
memory/4232-8-0x000001FB83500000-0x000001FB83508000-memory.dmp
memory/4232-9-0x000001FB9E4F0000-0x000001FB9E552000-memory.dmp
memory/4232-10-0x000001FB9E550000-0x000001FB9E592000-memory.dmp
memory/4232-11-0x000001FB83350000-0x000001FB8335A000-memory.dmp
memory/4232-12-0x000001FB84C00000-0x000001FB84C0A000-memory.dmp
memory/4232-13-0x000001FB9E5B0000-0x000001FB9E5CA000-memory.dmp
memory/4232-14-0x000001FB9E610000-0x000001FB9E632000-memory.dmp
memory/4232-15-0x000001FB832F0000-0x000001FB83300000-memory.dmp
memory/4232-20-0x000001FB84C20000-0x000001FB84C32000-memory.dmp
memory/4232-33-0x000001FB9E6E0000-0x000001FB9E760000-memory.dmp
memory/4232-37-0x000001FB9E590000-0x000001FB9E59A000-memory.dmp
memory/4232-36-0x000001FB9E790000-0x000001FB9E7CA000-memory.dmp
memory/4232-35-0x000001FB9D590000-0x000001FB9D5A4000-memory.dmp
memory/4232-34-0x000001FB9E760000-0x000001FB9E78A000-memory.dmp
memory/4232-32-0x000001FB9E690000-0x000001FB9E6DC000-memory.dmp
memory/4232-31-0x000001FB9E640000-0x000001FB9E68A000-memory.dmp
memory/4232-39-0x000001FB9E7D0000-0x000001FB9E7E6000-memory.dmp
memory/4232-43-0x000001FB9E850000-0x000001FB9E864000-memory.dmp
memory/4232-42-0x000001FB9E840000-0x000001FB9E850000-memory.dmp
memory/4232-41-0x000001FB9E810000-0x000001FB9E842000-memory.dmp
memory/4232-40-0x000001FB9E7E0000-0x000001FB9E814000-memory.dmp
memory/4232-38-0x000001FB9E5A0000-0x000001FB9E5AC000-memory.dmp