Analysis
- max time kernel
80s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
10/09/2022, 01:07
General
- Target 7dce0bef1561420915d2faf32c2e8e9a.exe
- Size 2.8MB
- Sample220910-bgm1dshdb5
- SHA256 44a76496a14571a06f0bc5601f05ec1881f212c32ea2b83855e2242a2ab75cbc
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
Newspo
C2
-
anubisgod.duckdns.org:1339
Mutex
-
67c78615-1015-46a3-aff1-f504bba1fa62
Attributes
-
encryption_key
0411D8B9B23547F86733347B0634010F112E158F
-
install_name
DABB.exe
-
log_directory
DABLogs
-
reconnect_delay
3000
-
startup_key
DABr Client Startup
-
subdirectory
DAB
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dce0bef1561420915d2faf32c2e8e9a.exe"C:\Users\Admin\AppData\Local\Temp\7dce0bef1561420915d2faf32c2e8e9a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DABr Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7dce0bef1561420915d2faf32c2e8e9a.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4892-132-0x00000000000E0000-0x00000000003AA000-memory.dmp
memory/4892-133-0x00007FFCC3A60000-0x00007FFCC4521000-memory.dmp
memory/4892-135-0x00007FFCC3A60000-0x00007FFCC4521000-memory.dmp