Analysis
- max time kernel
148s - max time network
164s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
14/10/2021, 15:21
General
- Target 46ee13b4e8a0cd58784a6845e271a00e.exe
- Size 502KB
- Sample211014-srbhsaagak
- SHA256 aa0a18dad402f0cfbd776899ece4ec642f451f8ad0ae5a5faa0682bf1ca21930
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
User
C2
-
104.248.133.59:5424
Mutex
-
aa0abdaa-9f94-49b1-98c9-82424402f208
Attributes
-
encryption_key
EC9F3C0FB5E251141748405014C913865BAD4EE2
-
install_name
mga.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft Graphics Adapter
-
subdirectory
MicrosoftGraphicsAdapter
Signatures
- Quasar Payload 2 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46ee13b4e8a0cd58784a6845e271a00e.exe"C:\Users\Admin\AppData\Local\Temp\46ee13b4e8a0cd58784a6845e271a00e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft Graphics Adapter" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\46ee13b4e8a0cd58784a6845e271a00e.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftGraphicsAdapter\mga.exe"C:\Users\Admin\AppData\Roaming\MicrosoftGraphicsAdapter\mga.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft Graphics Adapter" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\MicrosoftGraphicsAdapter\mga.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2056-115-0x0000000000410000-0x0000000000411000-memory.dmp
memory/2056-117-0x000000001B030000-0x000000001B032000-memory.dmp
memory/3824-124-0x000000001B820000-0x000000001B822000-memory.dmp
memory/3824-126-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/3824-127-0x000000001D780000-0x000000001D781000-memory.dmp