Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/09/2026, 18:55
General
- Target 13d1b5bcc807f84aa8ebd6f69a1013ac.exe
- Size 11.6MB
- Sample260907-xkyrystdke
- SHA256 acb54edce764ff6ee46bf23fcd7b0eb7347373bb9f9009f32e9da1cddb6b4621
Malware Config
Extracted
-
quasar
-
1.4.1
-
fuck2
-
9a7975b7-df6b-461a-82fc-4bd458e7aaf2
-
encryption_key
723A2B2A6F2EF73A3A133F7A10A174FDB6C54877
-
install_name
oasis.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Microsoft_Logs
-
reconnect_delay
300
-
startup_key
Quasar Client Startup
-
subdirectory
adobemirage
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13d1b5bcc807f84aa8ebd6f69a1013ac.exe"C:\Users\Admin\AppData\Local\Temp\13d1b5bcc807f84aa8ebd6f69a1013ac.exe"1⤵
- Creates a file in the Startup directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\office.exe"C:\Users\Admin\AppData\Local\Temp\office.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --disable-background-networking --disable-sync3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sd5565.bat" "3⤵
- Executes a command shell one-liner
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
office.exe
sd5565.bat
memory/3724-18-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-276-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-8-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-9-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-10-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-11-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-12-0x0000026D40A20000-0x0000026D40A3C000-memory.dmp
memory/3724-13-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-14-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-15-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-16-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-20-0x0000026D59430000-0x0000026D59442000-memory.dmp
memory/3724-7-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-4-0x00007FFD1E61F000-0x00007FFD1E620000-memory.dmp
memory/3724-17-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-21-0x0000026D59570000-0x0000026D59592000-memory.dmp
memory/3724-22-0x0000026D5B480000-0x0000026D5B4D0000-memory.dmp
memory/3724-23-0x0000026D5B590000-0x0000026D5B642000-memory.dmp
memory/3724-24-0x0000026D595A0000-0x0000026D595DC000-memory.dmp
memory/3724-25-0x0000026D5B430000-0x0000026D5B47C000-memory.dmp
memory/3724-28-0x0000026D5B4F0000-0x0000026D5B502000-memory.dmp
memory/3724-5-0x0000026D59C70000-0x0000026D5A2DE000-memory.dmp
memory/3724-6-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-363-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-19-0x0000026D594C0000-0x0000026D59572000-memory.dmp
memory/3724-250-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/3724-144-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp
memory/5148-138-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-119-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-52-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-51-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-50-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-49-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-47-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-55-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-48-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-39-0x00007FF63B7F0000-0x00007FF63B9A8000-memory.dmp
memory/5148-59-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-116-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-118-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-101-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-135-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-137-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-139-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-54-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-136-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-102-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-134-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-133-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-132-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-130-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-129-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-128-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-127-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-126-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-125-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-124-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-123-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-122-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-121-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-53-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-120-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-117-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-115-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-108-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-114-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-113-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-112-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-111-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-110-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-109-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-105-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-107-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-104-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-103-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-99-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-106-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-100-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-62-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-60-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-58-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-38-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-37-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-56-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-942-0x00007FF63B7F0000-0x00007FF63B9A8000-memory.dmp
memory/5148-1131-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-2116-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-2117-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-2118-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-2119-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-2121-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-2124-0x0000000140000000-0x000000014036C000-memory.dmp
memory/5148-57-0x0000000140000000-0x000000014036C000-memory.dmp