Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 07:48
General
- Target connect-sextop1-client.exe
- Size 3.1MB
- Sample260809-jnbvpsw1ds
- SHA256 7054a8967fd95f76792ad545a6cd543dbf5f02ece43a2c8951a0c4afea4f0070
Malware Config
Extracted
-
quasar
-
1.4.1
-
sextop1
-
sextop1.pl:443
-
sextop1.gl:443
-
sextop1.email:443
-
sextop1.cm:443
-
sextop1.fo:443
-
sextop1.am:443
-
sextop1.gd:443
-
sextop1.vg:443
-
sextop1.hot:443
-
sextop1.st:443
-
sextop1.fit:443
-
sextop1.skin:443
-
sextop1.moe:443
-
sextop1.work:443
-
sextop1.dad:443
-
sextop1.ing:443
-
sextop1.net:443
-
66.179.30.124:443
-
irena.ns.cloudflare.com:443
-
jake.ns.cloudflare.com:443
-
a01906ce-c109-4d42-8bd9-2e6b02d0599c
-
encryption_key
239ECC85C91C3110CB08E82C11B57BB8B6AD4392
-
install_name
connect-to-sextop1-client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 1 IoCs
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\connect-sextop1-client.exe"C:\Users\Admin\AppData\Local\Temp\connect-sextop1-client.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Myg0DaO7meZn.bat" "3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xqsW2IOzw9jq.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0IMrZzb94eNN.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"C:\Windows\system32\SubDir\connect-to-sextop1-client.exe"8⤵
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0IMrZzb94eNN.bat
Myg0DaO7meZn.bat
xqsW2IOzw9jq.bat
connect-to-sextop1-client.exe
memory/2764-29-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-19-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-42-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-34-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-31-0x000000001CEA0000-0x000000001CF52000-memory.dmp
memory/2764-30-0x000000001CD90000-0x000000001CDE0000-memory.dmp
memory/2764-28-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-27-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-26-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-25-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-24-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-23-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-17-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-18-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-16-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-22-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/2764-21-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-5-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-9-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-14-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-13-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-12-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-11-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-4-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-0-0x00007FFF4B65F000-0x00007FFF4B660000-memory.dmp
memory/4560-20-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-10-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-8-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-7-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-3-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-6-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-2-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp
memory/4560-1-0x0000000000540000-0x0000000000864000-memory.dmp