Analysis
- user interaction
yes - max time kernel
898s - max time network
900s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 18:36
General
- Target Client-2.exe
- Size 2.6MB
- Sample260809-w812jstdqg
- SHA256 4518753aea43be0fa3d6755f531d569a209b715616c076880b7cdd026eebf3d1
Malware Config
Extracted
-
quasar
-
1.6.6
-
Office04
-
c6qitux5e.localto.net:2164
-
b37c4cbf-68f4-4e7c-92ba-ac265729eb51
-
encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-2.exe"C:\Users\Admin\AppData\Local\Temp\Client-2.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2412-0-0x00007FFC2165F000-0x00007FFC21660000-memory.dmp
memory/2412-1-0x000001A8EC0A0000-0x000001A8EC33E000-memory.dmp
memory/2412-2-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-3-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-4-0x000001A8EE0F0000-0x000001A8EE10E000-memory.dmp
memory/2412-5-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-6-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-7-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-8-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-9-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-10-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-11-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-12-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-13-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-14-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-15-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-16-0x000001A8EE1E0000-0x000001A8EE21A000-memory.dmp
memory/2412-17-0x000001A8EE290000-0x000001A8EE2E0000-memory.dmp
memory/2412-18-0x000001A8EFCA0000-0x000001A8EFD52000-memory.dmp
memory/2412-19-0x000001A8EE220000-0x000001A8EE26A000-memory.dmp
memory/2412-21-0x000001A8EE330000-0x000001A8EE356000-memory.dmp
memory/2412-20-0x000001A8EE2E0000-0x000001A8EE32E000-memory.dmp
memory/2412-22-0x000001A8EEB40000-0x000001A8EEB74000-memory.dmp
memory/2412-23-0x000001A8EEB80000-0x000001A8EEBCC000-memory.dmp
memory/2412-24-0x000001A8EFBE0000-0x000001A8EFC2A000-memory.dmp
memory/2412-25-0x000001A8EFC30000-0x000001A8EFC5A000-memory.dmp
memory/2412-28-0x000001A8EFEB0000-0x000001A8EFEBA000-memory.dmp
memory/2412-29-0x000001A8EFED0000-0x000001A8EFED8000-memory.dmp
memory/2412-30-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-31-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp
memory/2412-32-0x00007FFC214D0000-0x00007FFC21E74000-memory.dmp