Analysis
- max time kernel
12s - max time network
143s - platform
windows10_x64 - resource
win10v20210410 - submitted
23/06/2021, 04:27
General
- Target b6ab9db1c2c1e606268a6f613cfcdf3d.exe
- Size 348KB
- Sample210623-2e5tpkwzka
- SHA256 f4070df8414261f9d218626189c7d3c303457fc6ea442ea413a42131f57cca21
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
microsoftupdate001.duckdns.org:8181
-
QSR_MUTEX_lcSkaiuYWXiGj5p7L5
-
encryption_key
IoLP1WwBgmTlOyHP9LJW
-
install_name
Audio.exe
-
log_directory
Logs
-
reconnect_delay
2000
-
startup_key
Realtek Audio Driver
-
subdirectory
SubDir
Signatures
- Quasar Payload 2 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6ab9db1c2c1e606268a6f613cfcdf3d.exe"C:\Users\Admin\AppData\Local\Temp\b6ab9db1c2c1e606268a6f613cfcdf3d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Realtek Audio Driver" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\b6ab9db1c2c1e606268a6f613cfcdf3d.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Audio.exe"C:\Users\Admin\AppData\Roaming\SubDir\Audio.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Realtek Audio Driver" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Audio.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2768-135-0x0000000006310000-0x0000000006311000-memory.dmp
memory/2768-130-0x00000000048F0000-0x00000000048F1000-memory.dmp
memory/3592-118-0x0000000004F70000-0x000000000546E000-memory.dmp
memory/3592-121-0x0000000006220000-0x0000000006221000-memory.dmp
memory/3592-120-0x0000000005E30000-0x0000000005E31000-memory.dmp
memory/3592-119-0x0000000005080000-0x0000000005081000-memory.dmp
memory/3592-114-0x0000000000620000-0x0000000000621000-memory.dmp
memory/3592-117-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/3592-116-0x0000000005470000-0x0000000005471000-memory.dmp