Analysis
- max time kernel
150s - max time network
156s - platform
windows10_x64 - resource
win10v20210408 - submitted
31/08/2021, 06:52
General
- Target fe920c2ba73fc82c4564e93fb39fd738aac91ffe5936d4e9bcfa3a14f9ef2863.exe
- Size 348KB
- Sample210831-adz5tl11ea
- SHA256 fe920c2ba73fc82c4564e93fb39fd738aac91ffe5936d4e9bcfa3a14f9ef2863
Score
10/10
Malware Config
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe920c2ba73fc82c4564e93fb39fd738aac91ffe5936d4e9bcfa3a14f9ef2863.exe"C:\Users\Admin\AppData\Local\Temp\fe920c2ba73fc82c4564e93fb39fd738aac91ffe5936d4e9bcfa3a14f9ef2863.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "pack" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\fe920c2ba73fc82c4564e93fb39fd738aac91ffe5936d4e9bcfa3a14f9ef2863.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1456-114-0x0000000000010000-0x0000000000011000-memory.dmp
memory/1456-116-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/1456-117-0x0000000004960000-0x0000000004961000-memory.dmp
memory/1456-118-0x00000000048C0000-0x0000000004DBE000-memory.dmp
memory/1456-119-0x00000000048C0000-0x00000000048C1000-memory.dmp
memory/1456-120-0x0000000005640000-0x0000000005641000-memory.dmp
memory/1456-121-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/1456-123-0x0000000005D80000-0x0000000005D81000-memory.dmp