Analysis
- geolocation tags
- max time kernel
899s - max time network
903s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 04:26
General
- Target SYSWOW64.exe
- Size 955KB
- Sample260806-e2hsysshrb
- SHA256 ef74d1c29ee00f4ebc57c52426c2ac194a34f8f0c150443e95fc1d4f2a13403b
Malware Config
Extracted
-
quasar
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SYSWOW64.exe"C:\Users\Admin\AppData\Local\Temp\SYSWOW64.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2948-0-0x00007FFEBC44F000-0x00007FFEBC450000-memory.dmp
memory/2948-1-0x0000025390060000-0x0000025390154000-memory.dmp
memory/2948-2-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-3-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-5-0x00000253905D0000-0x0000025390604000-memory.dmp
memory/2948-4-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-6-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-7-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-8-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-9-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-10-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-11-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-12-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-13-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-14-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-15-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-17-0x00000253AAA90000-0x00000253AAACC000-memory.dmp
memory/2948-18-0x00000253AB6E0000-0x00000253AB71E000-memory.dmp
memory/2948-22-0x00000253AB720000-0x00000253AB782000-memory.dmp
memory/2948-23-0x00000253AB780000-0x00000253AB7C2000-memory.dmp
memory/2948-24-0x0000025391F00000-0x0000025391F0A000-memory.dmp
memory/2948-26-0x00000253AB800000-0x00000253AB81A000-memory.dmp
memory/2948-25-0x00000253AA790000-0x00000253AA79A000-memory.dmp
memory/2948-27-0x00000253AB860000-0x00000253AB882000-memory.dmp
memory/2948-21-0x00000253AA7C0000-0x00000253AA7C8000-memory.dmp
memory/2948-20-0x00000253AAA50000-0x00000253AAA76000-memory.dmp
memory/2948-19-0x00000253AA780000-0x00000253AA78A000-memory.dmp
memory/2948-16-0x00000253AA7A0000-0x00000253AA7B2000-memory.dmp
memory/2948-28-0x00000253AA6F0000-0x00000253AA777000-memory.dmp
memory/2948-29-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-35-0x00000253AA7D0000-0x00000253AA7E2000-memory.dmp
memory/2948-45-0x00000253AB890000-0x00000253AB8DA000-memory.dmp
memory/2948-49-0x00000253AAA80000-0x00000253AAA94000-memory.dmp
memory/2948-50-0x00000253AB9B0000-0x00000253AB9EA000-memory.dmp
memory/2948-57-0x00000253ABA60000-0x00000253ABA74000-memory.dmp
memory/2948-56-0x00000253ABA50000-0x00000253ABA60000-memory.dmp
memory/2948-55-0x00000253ABA20000-0x00000253ABA52000-memory.dmp
memory/2948-54-0x00000253AB9F0000-0x00000253ABA24000-memory.dmp
memory/2948-53-0x00000253AB850000-0x00000253AB866000-memory.dmp
memory/2948-52-0x00000253AB7D0000-0x00000253AB7DC000-memory.dmp
memory/2948-51-0x00000253AB7C0000-0x00000253AB7CA000-memory.dmp
memory/2948-48-0x00000253AB820000-0x00000253AB84A000-memory.dmp
memory/2948-47-0x00000253AB930000-0x00000253AB9B0000-memory.dmp
memory/2948-46-0x00000253AB8E0000-0x00000253AB92C000-memory.dmp
memory/2948-58-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp
memory/2948-59-0x00007FFEBC2C0000-0x00007FFEBCC64000-memory.dmp