Analysis
- max time kernel
135s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/01/2021, 13:38
General
- Target 2e759ae068663ee6b9d63beee242a5b7.exe
- Size 971KB
- Sample210104-sk7xp9fl9x
- SHA256 60d4d26d3a67ea86d793602fa94ea83bdb8e888c4742b2a2601c68f577be4371
Malware Config
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Uses the VBS compiler for execution 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e759ae068663ee6b9d63beee242a5b7.exe"C:\Users\Admin\AppData\Local\Temp\2e759ae068663ee6b9d63beee242a5b7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xrejNBQDD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE47A.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-7-0x00000000072D0000-0x00000000072D1000-memory.dmp
memory/640-3-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/640-6-0x0000000007230000-0x0000000007231000-memory.dmp
memory/640-2-0x0000000073190000-0x000000007387E000-memory.dmp
memory/640-8-0x0000000007200000-0x000000000720E000-memory.dmp
memory/640-9-0x0000000004810000-0x00000000048A3000-memory.dmp
memory/640-5-0x0000000007690000-0x0000000007691000-memory.dmp
memory/1352-14-0x0000000073190000-0x000000007387E000-memory.dmp
memory/1352-12-0x0000000000400000-0x000000000045E000-memory.dmp
memory/1352-19-0x0000000009640000-0x0000000009641000-memory.dmp
memory/1352-20-0x000000000A1B0000-0x000000000A1B1000-memory.dmp
memory/1352-21-0x000000000A5A0000-0x000000000A5A1000-memory.dmp
memory/1352-22-0x000000000A910000-0x000000000A911000-memory.dmp