Analysis
- max time kernel
299s - max time network
302s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
27/08/2026, 10:27
General
- Target Pulsar-Client.exe
- Size 952KB
- Sample260827-mg3avsshnd
- SHA256 7f74156c9bf9a90b6eedaf3777a52dfbe1b67fa94a52f1cc068cbbd5266530b7
Malware Config
Extracted
-
quasar
-
encryption_key
33A7029011B6BD4B067B8907EB238F25EFF233BF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pulsar-Client.exe"C:\Users\Admin\AppData\Local\Temp\Pulsar-Client.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OivPqc4oa5tN.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /T 5 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
OivPqc4oa5tN.bat
memory/4356-40-0x0000018B46BE0000-0x0000018B46BF0000-memory.dmp
memory/4356-37-0x0000018B47CD0000-0x0000018B47D04000-memory.dmp
memory/4356-3-0x0000018B2D230000-0x0000018B2D242000-memory.dmp
memory/4356-4-0x0000018B45970000-0x0000018B459AC000-memory.dmp
memory/4356-7-0x0000018B459B0000-0x0000018B459B8000-memory.dmp
memory/4356-8-0x0000018B459C0000-0x0000018B45A22000-memory.dmp
memory/4356-6-0x0000018B2D260000-0x0000018B2D286000-memory.dmp
memory/4356-5-0x0000018B2B960000-0x0000018B2B96A000-memory.dmp
memory/4356-9-0x0000018B45B50000-0x0000018B45B92000-memory.dmp
memory/4356-10-0x0000018B2D250000-0x0000018B2D25A000-memory.dmp
memory/4356-12-0x0000018B45B90000-0x0000018B45BAA000-memory.dmp
memory/4356-11-0x0000018B2D290000-0x0000018B2D29A000-memory.dmp
memory/4356-13-0x0000018B46960000-0x0000018B46982000-memory.dmp
memory/4356-31-0x0000018B47C60000-0x0000018B47C8A000-memory.dmp
memory/4356-38-0x0000018B45BC0000-0x0000018B45BD0000-memory.dmp
memory/4356-0-0x0000018B2B320000-0x0000018B2B414000-memory.dmp
memory/4356-2-0x0000018B2B7C0000-0x0000018B2B7F4000-memory.dmp
memory/4356-36-0x0000018B46950000-0x0000018B46966000-memory.dmp
memory/4356-39-0x0000018B484F0000-0x0000018B48522000-memory.dmp
memory/4356-35-0x0000018B45BB0000-0x0000018B45BBC000-memory.dmp
memory/4356-34-0x0000018B45A30000-0x0000018B45A3A000-memory.dmp
memory/4356-33-0x0000018B47C90000-0x0000018B47CCA000-memory.dmp
memory/4356-32-0x0000018B45A20000-0x0000018B45A34000-memory.dmp
memory/4356-30-0x0000018B47BE0000-0x0000018B47C60000-memory.dmp
memory/4356-29-0x0000018B46B90000-0x0000018B46BDC000-memory.dmp
memory/4356-41-0x0000018B48520000-0x0000018B48534000-memory.dmp
memory/4356-28-0x0000018B46B40000-0x0000018B46B8A000-memory.dmp
memory/4356-42-0x0000018B45BC0000-0x0000018B45BD0000-memory.dmp
memory/4356-43-0x0000018B48780000-0x0000018B487B8000-memory.dmp
memory/4356-44-0x0000018B45BC0000-0x0000018B45BD0000-memory.dmp
memory/4356-45-0x0000018B46990000-0x0000018B46B37000-memory.dmp
memory/4356-1-0x0000018B45BC0000-0x0000018B45BD0000-memory.dmp
memory/4356-54-0x0000018B46990000-0x0000018B46B37000-memory.dmp