Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 12:35
General
- Target q3.exe
- Size 3.1MB
- Sample261003-psnb7azs7j
- SHA256 ef5cb3f567ff33c3f57084a37ce4f5b9e3a1fd61eb85320dfc2b865b3b2c9c1a
Malware Config
Extracted
-
quasar
-
1.4.1
-
s8
-
tn88.online:8080
-
tn88.online:80
-
ca78defd-890b-492a-8122-0f3798ba7cb2
-
encryption_key
2943DB5BBC1CE660309CB390FBE1E90BBBA6226E
-
install_name
Updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\q3.exe"C:\Users\Admin\AppData\Local\Temp\q3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\Updater.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Updater.exe
memory/3360-24-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-27-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-33-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-32-0x000000001CDE0000-0x000000001CE92000-memory.dmp
memory/3360-31-0x000000001CCD0000-0x000000001CD20000-memory.dmp
memory/3360-30-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-26-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-29-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-28-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-19-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-25-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-23-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-21-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-20-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-17-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-16-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/3360-18-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-10-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-11-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-14-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-13-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-22-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-12-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-1-0x0000000000F30000-0x0000000001254000-memory.dmp
memory/5708-0-0x00007FFA3124F000-0x00007FFA31250000-memory.dmp
memory/5708-9-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-2-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-8-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-7-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-6-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-5-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-4-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp
memory/5708-3-0x00007FFA310C0000-0x00007FFA31A64000-memory.dmp