Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/06/2021, 13:06
General
- Target 439e49a4df2f4bcc359283d02f612e98.exe
- Size 527KB
- Sample210624-tmff1at666
- SHA256 a792be03af23fe52b708d22df6cadeb3374bb5500416a862eee57ea56db20fd5
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
Office04
C2
-
45.77.20.114:1604
Mutex
-
39083318-6c39-4d8c-beda-fd48beb29cc9
Attributes
-
encryption_key
7E1D5BE8A11725FE11CAC5785F9684E24960D4AC
-
install_name
Media.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Media
-
subdirectory
SubDir
Signatures
- Quasar Payload 2 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\439e49a4df2f4bcc359283d02f612e98.exe"C:\Users\Admin\AppData\Local\Temp\439e49a4df2f4bcc359283d02f612e98.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Media" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\439e49a4df2f4bcc359283d02f612e98.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Media.exe"C:\Users\Admin\AppData\Roaming\SubDir\Media.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Media" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Media.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/656-114-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/656-116-0x0000000001130000-0x0000000001132000-memory.dmp
memory/2884-123-0x0000000000C60000-0x0000000000C62000-memory.dmp
memory/2884-125-0x0000000002750000-0x0000000002751000-memory.dmp
memory/2884-126-0x000000001B8D0000-0x000000001B8D1000-memory.dmp