Analysis
- geolocation tags
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/08/2026, 01:40
General
- Target MatrixDetector.exe
- Size 954KB
- Sample260815-b3yzsadj3t
- SHA256 cae7f48847ecc04bf2de3133363fb28997d0e1565dae18e53692900ea81d4642
Malware Config
Extracted
-
quasar
-
encryption_key
6DBF23FA65CBF8DE459BF11ED2A21BD998EF99BF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MatrixDetector.exe"C:\Users\Admin\AppData\Local\Temp\MatrixDetector.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4232-0-0x00007FFEA52FF000-0x00007FFEA5300000-memory.dmp
memory/4232-1-0x0000022C79010000-0x0000022C79104000-memory.dmp
memory/4232-2-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-3-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-4-0x0000022C795F0000-0x0000022C79624000-memory.dmp
memory/4232-5-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-6-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-7-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-8-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-9-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-10-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-11-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-12-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-13-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-15-0x0000022C7B820000-0x0000022C7B85C000-memory.dmp
memory/4232-14-0x0000022C7AFE0000-0x0000022C7AFF2000-memory.dmp
memory/4232-16-0x0000022C7B860000-0x0000022C7B89E000-memory.dmp
memory/4232-17-0x0000022C7AFC0000-0x0000022C7AFCA000-memory.dmp
memory/4232-20-0x0000022C7B8A0000-0x0000022C7B902000-memory.dmp
memory/4232-19-0x0000022C7AFD0000-0x0000022C7AFD8000-memory.dmp
memory/4232-21-0x0000022C7C9E0000-0x0000022C7CA22000-memory.dmp
memory/4232-18-0x0000022C7B7E0000-0x0000022C7B806000-memory.dmp
memory/4232-22-0x0000022C7B810000-0x0000022C7B81A000-memory.dmp
memory/4232-24-0x0000022C7CA70000-0x0000022C7CA8A000-memory.dmp
memory/4232-23-0x0000022C7B900000-0x0000022C7B90A000-memory.dmp
memory/4232-25-0x0000022C7CAD0000-0x0000022C7CAF2000-memory.dmp
memory/4232-26-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-35-0x0000022C7B910000-0x0000022C7B922000-memory.dmp
memory/4232-42-0x0000022C7CB00000-0x0000022C7CB4A000-memory.dmp
memory/4232-47-0x0000022C7CC30000-0x0000022C7CC6A000-memory.dmp
memory/4232-46-0x0000022C7CC20000-0x0000022C7CC34000-memory.dmp
memory/4232-49-0x0000022C7CC80000-0x0000022C7CC8C000-memory.dmp
memory/4232-48-0x0000022C7CC70000-0x0000022C7CC7A000-memory.dmp
memory/4232-45-0x0000022C7CA20000-0x0000022C7CA4A000-memory.dmp
memory/4232-44-0x0000022C7CBA0000-0x0000022C7CC20000-memory.dmp
memory/4232-43-0x0000022C7CB50000-0x0000022C7CB9C000-memory.dmp
memory/4232-54-0x0000022C7CD10000-0x0000022C7CD24000-memory.dmp
memory/4232-53-0x0000022C7CD00000-0x0000022C7CD10000-memory.dmp
memory/4232-52-0x0000022C7CCD0000-0x0000022C7CD02000-memory.dmp
memory/4232-51-0x0000022C7CCA0000-0x0000022C7CCD4000-memory.dmp
memory/4232-50-0x0000022C7CC90000-0x0000022C7CCA6000-memory.dmp
memory/4232-55-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-56-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-57-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp
memory/4232-58-0x00007FFEA5170000-0x00007FFEA5B14000-memory.dmp