Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 16:55
General
- Target 2026-08-11_9667cd028365bddc462f877ef19520b2_elex_glassworm_quasar-rat_remcos_wannacry_xrat.exe
- Size 468KB
- Sample260811-vfg8astxet
- SHA256 254bced58f482091984ffa2ceddf36ddcac96f40d43f3ff641692f2829bdd500
Malware Config
Extracted
-
quasar
-
2.0
-
huoyanshan
-
154.92.19.7:4782
-
QSR_MUTEX_ESRbaEG2E2EdYtSiNG
-
encryption_key
2rO1MdC7mMM9B7B4xczS
-
install_name
Microsoft.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
Microsoft
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Detects Windows executables referencing non-Windows User-Agents 3 IoCs
- Detects executables containing common artifacts observed in infostealers 3 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 46 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_9667cd028365bddc462f877ef19520b2_elex_glassworm_quasar-rat_remcos_wannacry_xrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_9667cd028365bddc462f877ef19520b2_elex_glassworm_quasar-rat_remcos_wannacry_xrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\e596b33.exe"C:\Users\Admin\AppData\Roaming\Microsoft\e596b33.exe" dmedmedme "C:\Users\Admin\AppData\Local\Temp\2026-08-11_9667cd028365bddc462f877ef19520b2_elex_glassworm_quasar-rat_remcos_wannacry_xrat.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe shimgvw.dll,ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\2026-08-11_9667cd028365bddc462f877ef19520b2_elex_glassworm_quasar-rat_remcos_wannacry_xrat.jpg3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\WindowsUpdate.exe3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
2026-08-11_9667cd028365bddc462f877ef19520b2_elex_glassworm_quasar-rat_remcos_wannacry_xrat.jpg
WindowsUpdate.exe
e596b33.exe
memory/5092-12-0x00000000002C0000-0x000000000031E000-memory.dmp
memory/5092-13-0x00000000054C0000-0x0000000005A7A000-memory.dmp
memory/5092-14-0x0000000004F00000-0x0000000004F92000-memory.dmp
memory/5092-15-0x0000000004E70000-0x0000000004ED6000-memory.dmp
memory/5092-16-0x0000000005B80000-0x0000000005B92000-memory.dmp
memory/5092-17-0x00000000061F0000-0x000000000622C000-memory.dmp
memory/5092-18-0x0000000006960000-0x000000000696A000-memory.dmp