Analysis
- user interaction
yes - max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 13:09
General
- Target Client-built.exe
- Size 1.8MB
- Sample260922-qd47tsfa86
- SHA256 936faed38fa85f481995a37af7963be3408970718464d52a6c1c498c1e01d6f2
Malware Config
Extracted
-
quasar
-
1.7.3
-
DDR7
-
DDR7-48221.portmap.host:48221
-
43cc31a6-a437-492a-bf75-0ae5e4101ed8
-
encryption_key
092A616347D3F0556BE769D540C41D6DDDEB17ED
-
install_name
ram.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
DDR7
-
subdirectory
DDR7
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 1 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DDR7" /sc ONLOGON /tr "C:\Windows\system32\DDR7\ram.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\DDR7\ram.exe"C:\Windows\system32\DDR7\ram.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DDR7" /sc ONLOGON /tr "C:\Windows\system32\DDR7\ram.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\DDR7\ram.exeC:\Windows\system32\DDR7\ram.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ram.exe
memory/944-34-0x000001AA3BCF0000-0x000001AA3BD2A000-memory.dmp
memory/944-39-0x000001AA3D0D0000-0x000001AA3D0E2000-memory.dmp
memory/944-49-0x000001AA3D320000-0x000001AA3D342000-memory.dmp
memory/944-48-0x000001AA3D2B0000-0x000001AA3D2CA000-memory.dmp
memory/944-47-0x000001AA3D120000-0x000001AA3D12A000-memory.dmp
memory/944-46-0x000001AA3D0C0000-0x000001AA3D0CA000-memory.dmp
memory/944-45-0x000001AA3D200000-0x000001AA3D242000-memory.dmp
memory/944-44-0x000001AA3D180000-0x000001AA3D1E2000-memory.dmp
memory/944-43-0x000001AA3D170000-0x000001AA3D178000-memory.dmp
memory/944-25-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-24-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-42-0x000001AA3D0F0000-0x000001AA3D116000-memory.dmp
memory/944-23-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-41-0x000001AA3D0B0000-0x000001AA3D0BA000-memory.dmp
memory/944-40-0x000001AA3D130000-0x000001AA3D16C000-memory.dmp
memory/944-33-0x000001AA23400000-0x000001AA23412000-memory.dmp
memory/944-17-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-19-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-20-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-38-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-21-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-22-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-35-0x000001AA3BD30000-0x000001AA3BD7C000-memory.dmp
memory/944-37-0x000001AA3BEE0000-0x000001AA3BF0A000-memory.dmp
memory/944-36-0x000001AA3BD80000-0x000001AA3BDCA000-memory.dmp
memory/944-26-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-27-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-28-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-29-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-30-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/944-31-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-13-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-10-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-11-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-2-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-0-0x00007FF8A41EF000-0x00007FF8A41F0000-memory.dmp
memory/5288-18-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-1-0x0000024167FF0000-0x00000241681BE000-memory.dmp
memory/5288-15-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-14-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-12-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-9-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-8-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-7-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-6-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-5-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-4-0x00007FF8A4060000-0x00007FF8A4A04000-memory.dmp
memory/5288-3-0x0000024169E60000-0x0000024169E8C000-memory.dmp