Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/11/2026, 11:15
General
- Target 96A22C9CE3CF02E3EBEBE814FB1E2B0A.exe
- Size 1.9MB
- Sample261109-ncppmsy1ct
- SHA256 8ae9be8826a832aee632cc05d4db71ddfdc522f50d5feab2bf1d6edbe21af20a
Malware Config
Extracted
-
quasar
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
500
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- PulsaRAT library module 1 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96A22C9CE3CF02E3EBEBE814FB1E2B0A.exe"C:\Users\Admin\AppData\Local\Temp\96A22C9CE3CF02E3EBEBE814FB1E2B0A.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1364-0-0x00007FF863C6F000-0x00007FF863C70000-memory.dmp
memory/1364-1-0x000001DA13C30000-0x000001DA13E20000-memory.dmp
memory/1364-2-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-3-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-4-0x000001DA142A0000-0x000001DA142BE000-memory.dmp
memory/1364-5-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-7-0x000001DA2EF80000-0x000001DA2EFD0000-memory.dmp
memory/1364-6-0x000001DA2E4D0000-0x000001DA2E50A000-memory.dmp
memory/1364-13-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-12-0x000001DA15CB0000-0x000001DA15CD6000-memory.dmp
memory/1364-15-0x000001DA2F020000-0x000001DA2F054000-memory.dmp
memory/1364-17-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-16-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-14-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-11-0x000001DA2EFD0000-0x000001DA2F01E000-memory.dmp
memory/1364-10-0x000001DA2EF30000-0x000001DA2EF7A000-memory.dmp
memory/1364-9-0x000001DA2F090000-0x000001DA2F142000-memory.dmp
memory/1364-18-0x000001DA2F150000-0x000001DA2F19C000-memory.dmp
memory/1364-20-0x000001DA2F060000-0x000001DA2F08A000-memory.dmp
memory/1364-19-0x000001DA2F1A0000-0x000001DA2F1EA000-memory.dmp
memory/1364-8-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-24-0x000001DA2FA00000-0x000001DA2FA3C000-memory.dmp
memory/1364-23-0x000001DA2F9A0000-0x000001DA2F9B2000-memory.dmp
memory/1364-25-0x000001DA2F9C0000-0x000001DA2F9CA000-memory.dmp
memory/1364-26-0x000001DA2F9E0000-0x000001DA2F9E8000-memory.dmp
memory/1364-27-0x00007FF863AE0000-0x00007FF864484000-memory.dmp
memory/1364-28-0x00007FF863AE0000-0x00007FF864484000-memory.dmp