Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/11/2026, 22:11
General
- Target 2026-11-14_f7920b03a1adcddb70d6b2f2feb2a841_amadey_coinminer_darkgate_elex_glassworm_icedid_poet-rat_quasar-rat_xrat.exe
- Size 3.3MB
- Sample261114-13zzhswt6m
- SHA256 89ff01b27527a31a519eeace1d2e730957b23230a10e3011b52bbc26e7329bf7
Malware Config
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-14_f7920b03a1adcddb70d6b2f2feb2a841_amadey_coinminer_darkgate_elex_glassworm_icedid_poet-rat_quasar-rat_xrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-14_f7920b03a1adcddb70d6b2f2feb2a841_amadey_coinminer_darkgate_elex_glassworm_icedid_poet-rat_quasar-rat_xrat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3960-0-0x00007FF84A94F000-0x00007FF84A950000-memory.dmp
memory/3960-1-0x0000000000A80000-0x0000000000DD0000-memory.dmp
memory/3960-2-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-4-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-5-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-6-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-7-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-8-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-9-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-10-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-12-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-11-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-13-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-16-0x0000000003110000-0x0000000003160000-memory.dmp
memory/3960-17-0x000000001CC60000-0x000000001CD12000-memory.dmp
memory/3960-20-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-21-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp
memory/3960-22-0x00007FF84A7C0000-0x00007FF84B164000-memory.dmp