Analysis
- max time kernel
149s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
27/10/2026, 12:42
General
- Target Client-built.exe
- Size 898KB
- Sample261027-pxewlstyb1
- SHA256 6736277b01741744fed0b7040ffda822a7810a6b7ef0faa6c79c2a7fc33da541
Malware Config
Extracted
-
quasar
-
1.5.1
-
dsc.gg/un1x
-
openport.pw:43910
-
b793e3e0-a400-4de4-b8c2-5204267d2218
-
encryption_key
CB770BFF9A5C5A8F92F2B4E2FE12549CF3DC3381
-
install_name
OfficeUpdater.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
2997
-
startup_key
Microsoft Updater
-
subdirectory
MicrosoftOffice
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4404-0-0x00000264674D0000-0x00000264675B6000-memory.dmp
memory/4404-1-0x0000026469B30000-0x0000026469B40000-memory.dmp
memory/4404-2-0x0000026469190000-0x00000264691AA000-memory.dmp
memory/4404-3-0x0000026469AA0000-0x0000026469AF0000-memory.dmp
memory/4404-4-0x000002646A900000-0x000002646A9B2000-memory.dmp
memory/4404-5-0x0000026469A50000-0x0000026469A9E000-memory.dmp
memory/4404-6-0x0000026469B30000-0x0000026469B40000-memory.dmp