Analysis
- user interaction
yes - max time kernel
262s - max time network
217s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
02/10/2026, 22:01
General
- Target Pulsar-ModifiedV2.zip
- Size 14.2MB
- Sample261002-1w649atfpd
- SHA256 b2d6d2cb6500e769a0d050e0737b21bd34e56c86941ee1b719d66bfd7d929a34
Malware Config
Extracted
-
quasar
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
5000
Extracted
-
quasar
-
1.6.6
-
Office04
-
127.0.0.1:4782
-
e10968fc-64ca-4bb8-99ad-879c94cb8393
-
encryption_key
D63146C9E99C2B9ABEEF78C2F49527EE71488A20
-
install_name
Client.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Pulsar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 3 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 3 IoCs
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Pulsar-ModifiedV2.zip1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Pulsar-ModifiedV2\" -spe -an -ai#7zMap8602:92:7zEvent102041⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Pulsar-ModifiedV2\" -spe -an -ai#7zMap27920:92:7zEvent212011⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\Pulsar-ModifiedV2\PulsarModifiedV2.exe"C:\Users\Admin\Desktop\Pulsar-ModifiedV2\PulsarModifiedV2.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" /select, "C:\Users\Admin\Desktop\Pulsar-ModifiedV2\Pulsar.p12"2⤵
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004C81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\Pulsar-ModifiedV2\PulsarModifiedV2.exe"C:\Users\Admin\Desktop\Pulsar-ModifiedV2\PulsarModifiedV2.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Client-built.exe"C:\Users\Admin\Downloads\Client-built.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PulsarModifiedV2.exe.log
5f06af3fac5e29b190874e4c5a3ea7ea_3ce5b361-a418-49f6-a3dc-b0185c2e35b7
BouncyCastle.Crypto.dll
Client.exe
Client.exe.Config
DiscordRPC.dll
Microsoft.Bcl.HashCode.dll
Mono.Cecil.dll
Newtonsoft.Json.dll
Open.Nat.dll
Pulsar.Common.dll
Pulsar.p12
PulsarModifiedV2.exe
PulsarModifiedV2.exe.config
settings.json
System.Buffers.dll
System.Collections.Immutable.dll
System.Formats.Nrbf.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.Reflection.Metadata.dll
System.Resources.Extensions.dll
System.Runtime.CompilerServices.Unsafe.dll
Vestris.ResourceLib.dll
dnlib.dll
protobuf-net.Core.dll
protobuf-net.dll
Client-built.exe
memory/1136-242-0x000001AB59A00000-0x000001AB59A34000-memory.dmp
memory/1136-250-0x000001AB5A190000-0x000001AB5A19A000-memory.dmp
memory/1136-237-0x000001AB3DE10000-0x000001AB3DE2E000-memory.dmp
memory/1136-236-0x000001AB3D6B0000-0x000001AB3D94C000-memory.dmp
memory/1136-240-0x000001AB599B0000-0x000001AB599FE000-memory.dmp
memory/1136-239-0x000001AB595E0000-0x000001AB5962A000-memory.dmp
memory/1136-238-0x000001AB59560000-0x000001AB5959A000-memory.dmp
memory/1136-243-0x000001AB59B30000-0x000001AB59B7C000-memory.dmp
memory/1136-241-0x000001AB595A0000-0x000001AB595C6000-memory.dmp
memory/1136-245-0x000001AB59A40000-0x000001AB59A6A000-memory.dmp
memory/1136-251-0x000001AB5A200000-0x000001AB5A208000-memory.dmp
memory/1136-244-0x000001AB59B80000-0x000001AB59BCA000-memory.dmp
memory/1136-249-0x000001AB5A160000-0x000001AB5A172000-memory.dmp
memory/1820-227-0x00000240D9B20000-0x00000240D9B3A000-memory.dmp
memory/1820-225-0x00000240DEDE0000-0x00000240DEE40000-memory.dmp
memory/2616-140-0x000001A22B4F0000-0x000001A22B510000-memory.dmp
memory/2616-193-0x000001A22C300000-0x000001A22C34A000-memory.dmp
memory/2616-138-0x000001A211560000-0x000001A21157E000-memory.dmp
memory/2616-136-0x000001A20F2C0000-0x000001A20F960000-memory.dmp
memory/2616-195-0x000001A22C7D0000-0x000001A22C81E000-memory.dmp
memory/2616-191-0x000001A22C2C0000-0x000001A22C2FC000-memory.dmp
memory/2616-190-0x000001A22E540000-0x000001A22E5F2000-memory.dmp
memory/2616-189-0x000001A22C270000-0x000001A22C2C0000-memory.dmp
memory/2616-188-0x000001A22C6A0000-0x000001A22C7C6000-memory.dmp
memory/2616-186-0x000001A22C200000-0x000001A22C218000-memory.dmp
memory/2616-165-0x000001A22C370000-0x000001A22C69E000-memory.dmp
memory/2616-144-0x000001A22B510000-0x000001A22B518000-memory.dmp
memory/2616-146-0x000001A22B520000-0x000001A22B53E000-memory.dmp
memory/2616-163-0x000001A22DD90000-0x000001A22DDAC000-memory.dmp
memory/2616-160-0x000001A22E2C0000-0x000001A22E2E2000-memory.dmp
memory/2616-159-0x000001A22E380000-0x000001A22E432000-memory.dmp
memory/2616-148-0x000001A22B910000-0x000001A22B926000-memory.dmp
memory/2616-142-0x000001A22B8E0000-0x000001A22B906000-memory.dmp
memory/2616-149-0x000001A211720000-0x000001A211728000-memory.dmp
memory/2616-151-0x000001A22DDF0000-0x000001A22DE70000-memory.dmp
memory/2616-153-0x000001A22DE70000-0x000001A22DEB2000-memory.dmp
memory/2616-157-0x000001A22B4D0000-0x000001A22B4DA000-memory.dmp
memory/2616-155-0x000001A22DDD0000-0x000001A22DDDA000-memory.dmp