Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/11/2026, 11:15
General
- Target 96A22C9CE3CF02E3EBEBE814FB1E2B0A.exe
- Size 1.9MB
- Sample261109-ncppmsy1ct
- SHA256 8ae9be8826a832aee632cc05d4db71ddfdc522f50d5feab2bf1d6edbe21af20a
Malware Config
Extracted
-
quasar
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
500
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 1 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96A22C9CE3CF02E3EBEBE814FB1E2B0A.exe"C:\Users\Admin\AppData\Local\Temp\96A22C9CE3CF02E3EBEBE814FB1E2B0A.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1812-0-0x0000029958A40000-0x0000029958C30000-memory.dmp
memory/1812-1-0x0000029973250000-0x0000029973260000-memory.dmp
memory/1812-2-0x0000029958FD0000-0x0000029958FEE000-memory.dmp
memory/1812-3-0x0000029973130000-0x000002997316A000-memory.dmp
memory/1812-4-0x00000299731F0000-0x0000029973240000-memory.dmp
memory/1812-5-0x0000029973510000-0x00000299735C2000-memory.dmp
memory/1812-7-0x0000029973450000-0x000002997349E000-memory.dmp
memory/1812-8-0x0000029959050000-0x0000029959076000-memory.dmp
memory/1812-6-0x00000299731A0000-0x00000299731EA000-memory.dmp
memory/1812-9-0x00000299734A0000-0x00000299734D4000-memory.dmp
memory/1812-10-0x00000299735D0000-0x000002997361C000-memory.dmp
memory/1812-12-0x000002995A8A0000-0x000002995A8CA000-memory.dmp
memory/1812-11-0x0000029973620000-0x000002997366A000-memory.dmp
memory/1812-15-0x00000299739B0000-0x00000299739C2000-memory.dmp
memory/1812-16-0x0000029973A10000-0x0000029973A4C000-memory.dmp
memory/1812-17-0x00000299739E0000-0x00000299739EA000-memory.dmp
memory/1812-18-0x0000029973A00000-0x0000029973A08000-memory.dmp
memory/1812-19-0x0000029973250000-0x0000029973260000-memory.dmp