Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 12:07
General
- Target x.bat 2.bat
- Size 10.1MB
- Sample261024-par8esbw7j
- SHA256 f357c6aa43a97fad3e6c4470db332dfcdcdd80956c335309741bc1d653477642
Malware Config
Extracted
-
quasar
-
encryption_key
C75C37F5794602D0FA11F69C27801E5DC319DB8F
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 2 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Payload decoded via CertUtil.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\x.bat 2.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\Temp\xcrcu96.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\x.bat 2.bat" cuxjkck"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\x.bat 2.bat" "C:\Users\Admin\AppData\Local\Temp\ftbnu14554.zip"4⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Windows\System32\tar.exe"C:\Windows\System32\tar.exe" -xf "C:\Users\Admin\AppData\Local\Temp\ftbnu14554.zip" -C "C:\Users\Admin\AppData\Local\System\aae65370"4⤵
-
-
C:\Users\Admin\AppData\Local\System\aae65370\PresentHost34693.exe"C:\Users\Admin\AppData\Local\System\aae65370\PresentHost34693.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
PresentHost34693.exe
VCRUNTIME140.dll
VCRUNTIME140_1.dll
adapter.png
libmfx64-gen.dll
libvplswref64.dll
msvcp140.dll
overlay.png
shell32.dll
43c99074e896e205f8b240da.dat
diag_report_21998.log
diag_report_21998.log
ftbnu14554.zip
xcrcu96.vbs
memory/4544-73-0x0000025145E50000-0x0000025145E51000-memory.dmp
memory/4544-84-0x000002515EC20000-0x000002515EC2A000-memory.dmp
memory/4544-70-0x0000025145740000-0x0000025145A3A000-memory.dmp
memory/4544-72-0x0000025145E50000-0x0000025145F44000-memory.dmp
memory/4544-65-0x0000025145100000-0x000002514541B000-memory.dmp
memory/4544-74-0x0000025145740000-0x0000025145A3A000-memory.dmp
memory/4544-75-0x0000025145F50000-0x0000025145FB2000-memory.dmp
memory/4544-77-0x0000025145E80000-0x0000025145E8A000-memory.dmp
memory/4544-76-0x0000025145E70000-0x0000025145E7A000-memory.dmp
memory/4544-79-0x000002515E550000-0x000002515E576000-memory.dmp
memory/4544-83-0x000002515EBE0000-0x000002515EC14000-memory.dmp
memory/4544-67-0x0000025145740000-0x0000025145A3A000-memory.dmp
memory/4544-82-0x000002515EBD0000-0x000002515EBDA000-memory.dmp
memory/4544-81-0x0000025145FB0000-0x0000025145FB8000-memory.dmp
memory/4544-80-0x0000025145EA0000-0x0000025145EBE000-memory.dmp
memory/4544-78-0x000002515E790000-0x000002515E7D2000-memory.dmp
memory/4544-54-0x0000025145740000-0x0000025145A3A000-memory.dmp
memory/4544-89-0x00007FFA43D50000-0x00007FFA43E9D000-memory.dmp
memory/4544-90-0x00007FFA3CC30000-0x00007FFA3CD5B000-memory.dmp
memory/4544-113-0x000002515EF30000-0x000002515EF6E000-memory.dmp
memory/4544-53-0x0000025145100000-0x000002514541B000-memory.dmp
memory/4544-52-0x0000025145420000-0x000002514573A000-memory.dmp