Finally, we see inside the ANY.RUN sandbox that the attack uses InstallUtil.exe, another legitimate Windows tool, to execute the malicious payload in memory, keeping the entire operation fileless and stealthy. This is the real danger of fileless malware: it hides in plain sight, using trusted system tools to carry out malicious actions without ever saving an actual file. We can clearly see this chain in the Process Tree section of the ANY.RUN sandbox, which helps teams quickly spot suspicious behavior and understand the attack flow spending less time and effort. By analyzing the Quasar RAT attack in ANY.RUN, analysts can easily trace how the malware operates in memory and spot suspicious behavior without the need for deep, manual forensics. Fileless malware is a type of malicious attack that doesn’t rely on files saved to a hard drive. The attack begins with a malicious script that abuses legitimate Windows tools — a Living-off-the-Land (LoLBaS)technique. This fileless attack uses a specially crafted loader, named Psloramyra, that takes advantage of Living-off-the-Land Binaries and Scripts (LoLBaS) to escalate privileges and avoid detection. At this point, no malware file is dropped onto the disk; the attack is already underway without leaving an obvious trace. To further evade detection, the attack injects the Quasar payload into RegSvcs.exe — a legitimate .NET system process. As you saw in the real-world analysis, even stealthy fileless attacks can be detected early, before they cause real damage to your business or security team. The analysis will take place inside the ANY.RUN sandbox, which provides complete visibility into each stage of the attack and allows for safe, in-depth investigation without risk to your environment. When the malware runs only in RAM and not from the CPU, as in this case, it’s a clear sign that the payload is executed directly in memory without leaving traces on disk. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. We see inside the ANY.RUN sandbox that the macro launches mshta.exe, a legitimate Windows tool, to fetch a malicious script from a shortened URL.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 02 Apr 2025 18:05:18 +0000