Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 18:09
General
- Target sOhph5kJoUBra.ps1
- Size 8KB
- Sample260807-wrxmsshc64
- SHA256 7796d6f9f191a79a2953ae2fde58fa744e878b75e1a3478010ea794d65ad1f13
Malware Config
Extracted
-
quasar
-
encryption_key
8168766659EB0B077B6079F5195209996ABA130D
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Detects DonutLoader 1 IoCs
- Quasar payload 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sOhph5kJoUBra.ps11⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\z5sgwrsi.u2c\7za.exe"C:\Users\Admin\AppData\Local\z5sgwrsi.u2c\7za.exe" x C:\Users\Admin\AppData\Local\z5sgwrsi.u2c\rnch0qjk.rbm.zip -oC:\Users\Admin\AppData\Local\z5sgwrsi.u2c\yqqa3ffu.kjw -poldkf2026 -y2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\z5sgwrsi.u2c\yqqa3ffu.kjw\EdgeElevator.exe"C:\Users\Admin\AppData\Local\z5sgwrsi.u2c\yqqa3ffu.kjw\EdgeElevator.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Edge\Core\GoogleCrashHandler.exeC:\Users\Admin\AppData\Roaming\Microsoft\Edge\Core\GoogleCrashHandler.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wstIaaRYn8mx.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\timeout.exetimeout /T 5 /NOBREAK3⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_mxdydntz.nic.ps1
wstIaaRYn8mx.bat
7za.exe
rnch0qjk.rbm.zip
EdgeElevator.exe
AForge.Video.DirectShow.dll
AForge.Video.dll
AForge.dll
Gma.System.MouseKeyHook.dll
NAudio.Core.dll
NAudio.Wasapi.dll
NAudio.WinForms.dll
NAudio.WinMM.dll
SharpDX.D3DCompiler.dll
SharpDX.DXGI.dll
SharpDX.Direct2D1.dll
SharpDX.Direct3D11.dll
SharpDX.Mathematics.dll
SharpDX.dll
memory/2612-77-0x0000000030780000-0x00000000307A2000-memory.dmp
memory/2612-107-0x0000000032360000-0x0000000032392000-memory.dmp
memory/2612-70-0x000000002FE90000-0x000000002FEB6000-memory.dmp
memory/2612-72-0x000000002FEC0000-0x000000002FF22000-memory.dmp
memory/2612-73-0x00000000305C0000-0x0000000030602000-memory.dmp
memory/2612-71-0x000000002EFD0000-0x000000002EFD8000-memory.dmp
memory/2612-74-0x0000000030650000-0x000000003065A000-memory.dmp
memory/2612-75-0x0000000030610000-0x000000003061A000-memory.dmp
memory/2612-76-0x0000000030700000-0x000000003071A000-memory.dmp
memory/2612-68-0x000000002CFE0000-0x000000002CFEA000-memory.dmp
memory/2612-97-0x0000000032140000-0x000000003218A000-memory.dmp
memory/2612-98-0x0000000032190000-0x00000000321DC000-memory.dmp
memory/2612-99-0x00000000321E0000-0x0000000032260000-memory.dmp
memory/2612-100-0x0000000032260000-0x000000003228A000-memory.dmp
memory/2612-101-0x00000000322A0000-0x00000000322B4000-memory.dmp
memory/2612-102-0x00000000322B0000-0x00000000322EA000-memory.dmp
memory/2612-103-0x00000000322F0000-0x00000000322FA000-memory.dmp
memory/2612-109-0x00000000323A0000-0x00000000323B4000-memory.dmp
memory/2612-108-0x0000000032390000-0x00000000323A0000-memory.dmp
memory/2612-69-0x000000002FE10000-0x000000002FE76000-memory.dmp
memory/2612-106-0x0000000032330000-0x0000000032364000-memory.dmp
memory/2612-105-0x0000000032310000-0x0000000032326000-memory.dmp
memory/2612-104-0x0000000032300000-0x000000003230C000-memory.dmp
memory/2612-67-0x000000002EFF0000-0x000000002F028000-memory.dmp
memory/2612-66-0x000000002EF90000-0x000000002EFCC000-memory.dmp
memory/2612-65-0x000000002BCE0000-0x000000002BCF2000-memory.dmp
memory/2612-62-0x000000002BC20000-0x000000002BC2A000-memory.dmp
memory/2612-61-0x000000002B210000-0x000000002B246000-memory.dmp
memory/2612-60-0x000000002B130000-0x000000002B1C2000-memory.dmp
memory/2612-59-0x000000002B480000-0x000000002BA24000-memory.dmp
memory/2612-58-0x000000002B3A0000-0x000000002B47E000-memory.dmp
memory/2612-56-0x0000000003AC0000-0x0000000003B9C000-memory.dmp
memory/3548-14-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp
memory/3548-12-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp
memory/3548-9-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp
memory/3548-7-0x00000237A3B60000-0x00000237A3B82000-memory.dmp
memory/3548-0-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp
memory/3548-15-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp
memory/3548-16-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp
memory/3548-25-0x00000237A3BA0000-0x00000237A3BB0000-memory.dmp