Analysis
- max time kernel
33s - max time network
138s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/08/2021, 09:33
General
- Target 07d0c0de71b135af74f710585f13aa33.exe
- Size 659KB
- Sample210809-ld89gm3bc2
- SHA256 d977d80c3735df4761faf5e37f8f4874b36d2c1d6aaa731f4e37b36c813e5754
Malware Config
Extracted
-
quasar
-
1.4.0
-
Office04w
-
societyf500.ddns.net:5490
-
f4264bdc-b486-4a30-a042-2bcfb907b3c7
-
encryption_key
0204DFA093E27B72F1617CCEA6076BCCE5D0A482
-
install_name
dwmq.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
dwmq
-
subdirectory
explorer
Signatures
- Quasar Payload 2 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe"C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exeC:\Users\Admin\AppData\Local\Temp\07d0c0de71b135af74f710585f13aa33.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/564-123-0x00000000070D0000-0x000000000713C000-memory.dmp
memory/564-116-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
memory/564-118-0x00000000055C0000-0x0000000005ABE000-memory.dmp
memory/564-119-0x0000000005590000-0x0000000005591000-memory.dmp
memory/564-120-0x00000000079A0000-0x00000000079A1000-memory.dmp
memory/564-121-0x0000000006FC0000-0x0000000007037000-memory.dmp
memory/564-117-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/564-122-0x0000000007040000-0x0000000007041000-memory.dmp
memory/564-114-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/2960-124-0x0000000000400000-0x0000000000484000-memory.dmp
memory/2960-132-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/2960-133-0x0000000005EA0000-0x0000000005EA1000-memory.dmp
memory/2960-134-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/2960-135-0x0000000005B00000-0x0000000005B01000-memory.dmp
memory/2960-136-0x0000000006FE0000-0x0000000006FE1000-memory.dmp