Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 04:37
General
- Target 2026-08-22_1bd8f7f7a62ae7bfa7d4217a4bfdc07d_cobalt-strike_glassworm_megazord_satacom_vidar.exe
- Size 3.7MB
- Sample260822-e8xwfseb73
- SHA256 56cd3e2ef63ba00b0900c6f31a0d5d70378c83125d20671c041cc0c0857ca07c
Malware Config
Extracted
-
quasar
-
1.4.0
-
Kan09
-
4Mekey.myftp.biz:4782
-
38b17bb4-3d9b-45a0-8b80-3228914875b6
-
encryption_key
DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A
-
install_name
Windows Update.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft Windows
-
subdirectory
System32
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_1bd8f7f7a62ae7bfa7d4217a4bfdc07d_cobalt-strike_glassworm_megazord_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_1bd8f7f7a62ae7bfa7d4217a4bfdc07d_cobalt-strike_glassworm_megazord_satacom_vidar.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1160-0-0x00007FF6E43B0000-0x00007FF6E476D000-memory.dmp
memory/1160-1-0x00007FF8874FF000-0x00007FF887501000-memory.dmp
memory/1160-2-0x00007FF8873A0000-0x00007FF887603000-memory.dmp
memory/1160-3-0x00007FF8873A0000-0x00007FF887603000-memory.dmp
memory/3536-4-0x00007FF8873A0000-0x00007FF887603000-memory.dmp
memory/3536-5-0x0000000000400000-0x0000000000484000-memory.dmp
memory/3536-6-0x0000000005560000-0x0000000005B1A000-memory.dmp
memory/3536-7-0x0000000004FA0000-0x0000000005032000-memory.dmp
memory/3536-8-0x00007FF8873A0000-0x00007FF887603000-memory.dmp
memory/3536-9-0x0000000004F50000-0x0000000004F5A000-memory.dmp
memory/3536-10-0x0000000006B40000-0x0000000007158000-memory.dmp
memory/3536-11-0x00000000053C0000-0x0000000005410000-memory.dmp
memory/3536-12-0x00000000065F0000-0x00000000066A2000-memory.dmp
memory/3536-13-0x00007FF8873A0000-0x00007FF887603000-memory.dmp