Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
18/09/2026, 22:40
General
- Target Prestige Launcher (2).exe
- Size 3.2MB
- Sample260918-2lpb5atbld
- SHA256 948e378ec01b0a9ccee144fe17290874d53eb9a686bae952643cfe30a0c3355b
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
192.168.11.41:139
-
aa4a2ba4-5541-49d5-938d-dcc66534489c
-
encryption_key
B0269B148C1775F4FBC2A4C271087C43E0AC4A02
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RtkAudUService32
-
subdirectory
tr-TN
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Prestige Launcher (2).exe"C:\Users\Admin\AppData\Local\Temp\Prestige Launcher (2).exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudUService32" /sc ONLOGON /tr "C:\Windows\system32\tr-TN\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\tr-TN\Client.exe"C:\Windows\system32\tr-TN\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RtkAudUService32" /sc ONLOGON /tr "C:\Windows\system32\tr-TN\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\tr-TN\Client.exeC:\Windows\system32\tr-TN\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
memory/2916-24-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-26-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-34-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-33-0x000000001CC50000-0x000000001CD02000-memory.dmp
memory/2916-32-0x000000001B510000-0x000000001B560000-memory.dmp
memory/2916-30-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-29-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-28-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-27-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-19-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-25-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-22-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-21-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-20-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-17-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-16-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/2916-18-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-10-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-11-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-14-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-13-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-23-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-12-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-1-0x0000000000B30000-0x0000000000E60000-memory.dmp
memory/3148-0-0x00007FFB3DF3F000-0x00007FFB3DF40000-memory.dmp
memory/3148-9-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-2-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-8-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-7-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-6-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-5-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-4-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp
memory/3148-3-0x00007FFB3DDB0000-0x00007FFB3E754000-memory.dmp