Analysis
-
max time kernel
130s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2023, 15:13
General
-
Target
486a7709a844ef4a1770299b51b3bdd519c8881ea3190705ab7890780998e84a.exe
-
Size
502KB
-
MD5
b5b0a0a082b9f9ed7e1216805dce73dc
-
SHA1
ebc4c036a30a003a399c6c1a6fd96fbd60cbbf35
-
SHA256
486a7709a844ef4a1770299b51b3bdd519c8881ea3190705ab7890780998e84a
-
SHA512
4c025030525fcbb0de7b7890ccf8c9b9c9e09bb25e1adbdc9f8e5e49097531c7bf4ebde85ec36409e743c3b079133d9527aae70c6bb5dc733aa2a671889b4158
-
SSDEEP
6144:ITEgdc0YYXAGbgiIN2RSBMUZz6wudTEDQK6DkQfocEgOb8F9vWlM3lBi0U3vLcTQ:ITEgdfYqbgjqDkwp9WCY0UfLcdm
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
Office04
C2
xsaz3412.duckdns.org:4782
Mutex
339a0ca9-655c-474f-ae0b-8b93c0a5acb0
Attributes
-
encryption_key
5BA53C22C08AF30F643D1CE3AEA974DFD7C76979
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/3192-132-0x0000000000290000-0x0000000000314000-memory.dmp family_quasar -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3192 486a7709a844ef4a1770299b51b3bdd519c8881ea3190705ab7890780998e84a.exe