Analysis
- geolocation tags
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 01:40
General
- Target MatrixDetector.exe
- Size 954KB
- Sample260815-b3v8wsdj21
- SHA256 cae7f48847ecc04bf2de3133363fb28997d0e1565dae18e53692900ea81d4642
Malware Config
Extracted
-
quasar
-
encryption_key
6DBF23FA65CBF8DE459BF11ED2A21BD998EF99BF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MatrixDetector.exe"C:\Users\Admin\AppData\Local\Temp\MatrixDetector.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1100-0-0x00007FF96012F000-0x00007FF960130000-memory.dmp
memory/1100-1-0x000001A94A7E0000-0x000001A94A8D4000-memory.dmp
memory/1100-2-0x000001A94C660000-0x000001A94C694000-memory.dmp
memory/1100-3-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-4-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-5-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-6-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-7-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-8-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-9-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-10-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-11-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-13-0x000001A964F10000-0x000001A964F4C000-memory.dmp
memory/1100-12-0x000001A964EB0000-0x000001A964EC2000-memory.dmp
memory/1100-14-0x000001A9661B0000-0x000001A9661EE000-memory.dmp
memory/1100-15-0x000001A964E80000-0x000001A964E8A000-memory.dmp
memory/1100-17-0x000001A966240000-0x000001A966248000-memory.dmp
memory/1100-16-0x000001A964ED0000-0x000001A964EF6000-memory.dmp
memory/1100-18-0x000001A966250000-0x000001A9662B2000-memory.dmp
memory/1100-19-0x000001A9662B0000-0x000001A9662F2000-memory.dmp
memory/1100-20-0x000001A964F00000-0x000001A964F0A000-memory.dmp
memory/1100-21-0x000001A9661F0000-0x000001A9661FA000-memory.dmp
memory/1100-22-0x000001A966220000-0x000001A96623A000-memory.dmp
memory/1100-23-0x000001A966350000-0x000001A966372000-memory.dmp
memory/1100-24-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp
memory/1100-33-0x000001A966200000-0x000001A966212000-memory.dmp
memory/1100-40-0x000001A9662F0000-0x000001A96633A000-memory.dmp
memory/1100-52-0x000001A966550000-0x000001A966564000-memory.dmp
memory/1100-51-0x000001A966540000-0x000001A966550000-memory.dmp
memory/1100-50-0x000001A966510000-0x000001A966542000-memory.dmp
memory/1100-49-0x000001A9664E0000-0x000001A966514000-memory.dmp
memory/1100-48-0x000001A9664D0000-0x000001A9664E6000-memory.dmp
memory/1100-47-0x000001A9664C0000-0x000001A9664CC000-memory.dmp
memory/1100-46-0x000001A966340000-0x000001A96634A000-memory.dmp
memory/1100-45-0x000001A966480000-0x000001A9664BA000-memory.dmp
memory/1100-44-0x000001A966210000-0x000001A966224000-memory.dmp
memory/1100-43-0x000001A966450000-0x000001A96647A000-memory.dmp
memory/1100-42-0x000001A9663D0000-0x000001A966450000-memory.dmp
memory/1100-41-0x000001A966380000-0x000001A9663CC000-memory.dmp