Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 00:21
General
- Target 9ec3cecefe6abf353b8c6ba85dacd48afb8440c0855fb9060d7a5c6a832d6dc2.msi
- Size 1.4MB
- Sample261113-ancybsdz7x
- SHA256 9ec3cecefe6abf353b8c6ba85dacd48afb8440c0855fb9060d7a5c6a832d6dc2
Malware Config
Extracted
-
quasar
-
encryption_key
80C8E203FBDDF344A26ECDDB268773B8E86195A9
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Detects DonutLoader 1 IoCs
- PulsaRAT library module 2 IoCs
Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
- Quasar payload 1 IoCs
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 11 IoCs
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 55 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\9ec3cecefe6abf353b8c6ba85dacd48afb8440c0855fb9060d7a5c6a832d6dc2.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Platform\hdqxzoot\SyncClient072367.exeC:\Users\Admin\AppData\Local\Platform\hdqxzoot\\SyncClient072367.exe1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
e5928bf.rbs
SyncClient072367.exe
memory/5240-16-0x0000000002880000-0x00000000029DC000-memory.dmp
memory/5240-18-0x0000000002AE0000-0x0000000002C3B000-memory.dmp
memory/5240-19-0x0000000005740000-0x000000000589C000-memory.dmp
memory/5240-20-0x0000000005E70000-0x000000000642A000-memory.dmp
memory/5240-21-0x00000000058B0000-0x0000000005942000-memory.dmp
memory/5240-22-0x00000000056A0000-0x00000000056D8000-memory.dmp
memory/5240-23-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/5240-24-0x0000000007D00000-0x0000000007D12000-memory.dmp
memory/5240-25-0x0000000007D60000-0x0000000007D9C000-memory.dmp
memory/5240-26-0x0000000007DE0000-0x0000000007E1E000-memory.dmp
memory/5240-27-0x0000000007D40000-0x0000000007D4A000-memory.dmp
memory/5240-28-0x00000000080D0000-0x0000000008136000-memory.dmp
memory/5240-29-0x0000000008070000-0x0000000008096000-memory.dmp
memory/5240-30-0x00000000080C0000-0x00000000080C8000-memory.dmp
memory/5240-31-0x00000000082A0000-0x0000000008302000-memory.dmp
memory/5240-32-0x0000000008320000-0x0000000008362000-memory.dmp
memory/5240-33-0x0000000008380000-0x000000000838A000-memory.dmp
memory/5240-35-0x0000000008610000-0x000000000862A000-memory.dmp
memory/5240-34-0x0000000008300000-0x000000000830A000-memory.dmp
memory/5240-36-0x00000000086C0000-0x00000000086E2000-memory.dmp
memory/5240-41-0x0000000008670000-0x0000000008682000-memory.dmp
memory/5240-52-0x0000000008980000-0x00000000089CA000-memory.dmp
memory/5240-64-0x0000000008D30000-0x0000000008D44000-memory.dmp
memory/5240-63-0x0000000008D20000-0x0000000008D30000-memory.dmp
memory/5240-62-0x0000000008CF0000-0x0000000008D22000-memory.dmp
memory/5240-61-0x0000000008CC0000-0x0000000008CF4000-memory.dmp
memory/5240-60-0x0000000008CA0000-0x0000000008CB6000-memory.dmp
memory/5240-59-0x0000000008C90000-0x0000000008C9C000-memory.dmp
memory/5240-58-0x0000000008C80000-0x0000000008C8A000-memory.dmp
memory/5240-57-0x0000000008C40000-0x0000000008C7A000-memory.dmp
memory/5240-53-0x00000000089D0000-0x0000000008A1C000-memory.dmp
memory/5240-56-0x0000000008C30000-0x0000000008C44000-memory.dmp
memory/5240-55-0x0000000008BF0000-0x0000000008C1A000-memory.dmp
memory/5240-54-0x0000000008B60000-0x0000000008BE0000-memory.dmp