Analysis
- max time kernel
300s - max time network
301s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 07:00
General
- Target buildet.exe
- Size 3.1MB
- Sample261029-hs2fgsa16l
- SHA256 3770d87bec40bb0c2e382b8b87e64ca7cf7e8e355451ff9e0c45a1de3eb605ef
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
2.tcp.eu.ngrok.io:26430
-
5.tcp.eu.ngrok.io:21383
-
5.tcp.eu.ngrok.io:18409
-
expressing-product.tun.ply.gg:18891
-
2ybz0esa.free.tryportwarp.cc::16268
-
697403f2-515b-4438-aea2-8a5e62f07697
-
encryption_key
28F9DE2842B51C675BB32A7C662F971EAC0B5A17
-
install_name
MicrosoftUpdater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
MicrosoftUpdater
-
subdirectory
Microsoft
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\buildet.exe"C:\Users\Admin\AppData\Local\Temp\buildet.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bpWO4euj60Dr.bat" "3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HtntnORzVA8e.bat" "5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"6⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o6PlSASsw2iT.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"8⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jZ1tFZTxVbr7.bat" "9⤵
- Executes a command shell one-liner
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe"10⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MicrosoftUpdater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exeC:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftUpdater.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
HtntnORzVA8e.bat
bpWO4euj60Dr.bat
jZ1tFZTxVbr7.bat
o6PlSASsw2iT.bat
MicrosoftUpdater.exe
memory/2996-33-0x000000001C6A0000-0x000000001C752000-memory.dmp
memory/2996-29-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-42-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-35-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-34-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-28-0x0000000002A30000-0x0000000002A80000-memory.dmp
memory/2996-32-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-31-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-30-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-25-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-27-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-26-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-18-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-17-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-20-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-21-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-22-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-23-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/2996-24-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-14-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-16-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-5-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-6-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-13-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-12-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-0-0x00007FF92149F000-0x00007FF9214A0000-memory.dmp
memory/4952-11-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-10-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-9-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-8-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-4-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-7-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-3-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-2-0x00007FF921310000-0x00007FF921CB4000-memory.dmp
memory/4952-1-0x0000000000F30000-0x0000000001254000-memory.dmp