Analysis
- user interaction
yes - max time kernel
76s - max time network
79s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
06/08/2026, 03:58
General
- Target pastlavan.exe
- Size 1.2MB
- Sample260806-ejjmjasfre
- SHA256 2f9d1c4c241d751019ccf4006ad034d9fc619902a28702e0075b1ec0cc38e534
Malware Config
Extracted
-
quasar
-
encryption_key
33A7029011B6BD4B067B8907EB238F25EFF233BF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Drops file in System32 directory 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\pastlavan.exe"C:\Users\Admin\AppData\Local\Temp\pastlavan.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SystemHelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemHelper.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SubDir\SystemHelper.exe"C:\Windows\system32\SubDir\SystemHelper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SystemHelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemHelper.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\lCxmcHB06ZbF.exe"C:\Users\Admin\AppData\Local\Temp\lCxmcHB06ZbF.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\SubDir\SystemHelper.exeC:\Windows\system32\SubDir\SystemHelper.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
lCxmcHB06ZbF.exe
SystemHelper.exe
memory/2260-75-0x0000013C57710000-0x0000013C578B9000-memory.dmp
memory/2260-73-0x0000013C57710000-0x0000013C578B9000-memory.dmp
memory/2260-71-0x0000013C57710000-0x0000013C578B9000-memory.dmp
memory/2260-69-0x0000013C3C360000-0x0000013C3C6D2000-memory.dmp
memory/3052-0-0x000001D9C1BB0000-0x000001D9C1CE6000-memory.dmp
memory/3052-1-0x000001D9C3AE0000-0x000001D9C3AF0000-memory.dmp
memory/3052-2-0x000001D9C3A20000-0x000001D9C3A54000-memory.dmp
memory/3752-51-0x0000025EC13D0000-0x0000025EC13E4000-memory.dmp
memory/3752-47-0x0000025EC1180000-0x0000025EC1196000-memory.dmp
memory/3752-18-0x0000025EC0E00000-0x0000025EC0E08000-memory.dmp
memory/3752-17-0x0000025EBFFF0000-0x0000025EC0016000-memory.dmp
memory/3752-20-0x0000025EC1100000-0x0000025EC1142000-memory.dmp
memory/3752-21-0x0000025EBFFB0000-0x0000025EBFFBA000-memory.dmp
memory/3752-22-0x0000025EBFFC0000-0x0000025EBFFCA000-memory.dmp
memory/3752-23-0x0000025EC1160000-0x0000025EC117A000-memory.dmp
memory/3752-24-0x0000025EC11E0000-0x0000025EC1202000-memory.dmp
memory/3752-39-0x0000025EC1210000-0x0000025EC125A000-memory.dmp
memory/3752-40-0x0000025EC1260000-0x0000025EC12AC000-memory.dmp
memory/3752-16-0x0000025EA7870000-0x0000025EA787A000-memory.dmp
memory/3752-50-0x0000025EC11D0000-0x0000025EC11E0000-memory.dmp
memory/3752-49-0x0000025EC13A0000-0x0000025EC13D2000-memory.dmp
memory/3752-48-0x0000025EC1370000-0x0000025EC13A4000-memory.dmp
memory/3752-19-0x0000025EC0EA0000-0x0000025EC0F02000-memory.dmp
memory/3752-46-0x0000025EC1150000-0x0000025EC115C000-memory.dmp
memory/3752-45-0x0000025EC1140000-0x0000025EC114A000-memory.dmp
memory/3752-44-0x0000025EC1330000-0x0000025EC136A000-memory.dmp
memory/3752-43-0x0000025EC0DE0000-0x0000025EC0DF4000-memory.dmp
memory/3752-42-0x0000025EC11A0000-0x0000025EC11CA000-memory.dmp
memory/3752-41-0x0000025EC12B0000-0x0000025EC1330000-memory.dmp
memory/3752-53-0x0000025EA5E80000-0x0000025EA5E90000-memory.dmp
memory/3752-52-0x0000025EC1420000-0x0000025EC15C9000-memory.dmp
memory/3752-54-0x0000025EC1420000-0x0000025EC15C9000-memory.dmp
memory/3752-55-0x0000025EC1420000-0x0000025EC15C9000-memory.dmp
memory/3752-15-0x0000025EC0E60000-0x0000025EC0E98000-memory.dmp
memory/3752-14-0x0000025EC0E20000-0x0000025EC0E5C000-memory.dmp
memory/3752-13-0x0000025EBFFD0000-0x0000025EBFFE2000-memory.dmp
memory/3752-10-0x0000025EA5EA0000-0x0000025EA5ED4000-memory.dmp
memory/3752-74-0x0000025EC1420000-0x0000025EC15C9000-memory.dmp
memory/3752-9-0x0000025EA5E80000-0x0000025EA5E90000-memory.dmp