Analysis
- max time kernel
125s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
23/03/2022, 13:37
General
- Target aa551c7de85ef21b2ea8d377d79a5e6a.exe
- Size 2.7MB
- Sample220323-qwvfcabdaq
- SHA256 0b84e664c8b592aa0220d52841629b2accb41f1f624720331000ab5f2f0ed628
Malware Config
Extracted
-
quasar
-
1.4.0
-
Office04
-
ms-insider.net:1604
-
811c1960-874e-401e-bbd2-0d8560af92ea
-
encryption_key
4795EB97A05AE5F4E669D4B7FFF6608D94FC9027
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
5000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar Payload 1 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa551c7de85ef21b2ea8d377d79a5e6a.exe"C:\Users\Admin\AppData\Local\Temp\aa551c7de85ef21b2ea8d377d79a5e6a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2852-134-0x00000000007C0000-0x0000000000A80000-memory.dmp
memory/2852-135-0x00007FFB68380000-0x00007FFB68E41000-memory.dmp
memory/2852-136-0x000000001CD60000-0x000000001CD62000-memory.dmp
memory/2852-137-0x000000001DAA0000-0x000000001DAF0000-memory.dmp
memory/2852-138-0x000000001DBB0000-0x000000001DC62000-memory.dmp