Analysis
- max time kernel
53s - max time network
152s - platform
windows10-1703_x64 - resource
win10-20220812-en - resource tags
- submitted
18/01/2023, 12:18
General
- Target 3ecf24e572980c093d67046cf6480284f96224e3e887ef3854428e1fec0adc87.exe
- Size 348KB
- Sample230118-pgqceage99
- SHA256 3ecf24e572980c093d67046cf6480284f96224e3e887ef3854428e1fec0adc87
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
188.119.45.143:9896
-
microsoftstolewindows.duckdns.org:9896
-
192.168.1.52:9896
-
QSR_MUTEX_ZhL1p5SiHTlBKUYEsI
-
encryption_key
sBg2G8lxZ2VaMwfKc6V3
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 4 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ecf24e572980c093d67046cf6480284f96224e3e887ef3854428e1fec0adc87.exe"C:\Users\Admin\AppData\Local\Temp\3ecf24e572980c093d67046cf6480284f96224e3e887ef3854428e1fec0adc87.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\3ecf24e572980c093d67046cf6480284f96224e3e887ef3854428e1fec0adc87.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\SubDir\svchost.exe"C:\Windows\SysWOW64\SubDir\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\svchost.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
svchost.exe
memory/1720-315-0x0000000007320000-0x000000000732A000-memory.dmp
memory/4936-149-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-148-0x0000000000E30000-0x0000000000E8E000-memory.dmp
memory/4936-118-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-119-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-120-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-121-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-122-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-123-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-124-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-125-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-126-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-127-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-128-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-129-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-130-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-131-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-132-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-133-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-134-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-135-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-136-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-137-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-138-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-139-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-140-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-141-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-142-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-143-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-144-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-145-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-146-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-147-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-151-0x0000000005AF0000-0x0000000005FEE000-memory.dmp
memory/4936-116-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-117-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-150-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-165-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-153-0x0000000005700000-0x0000000005792000-memory.dmp
memory/4936-154-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-155-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-156-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-157-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-158-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-159-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-160-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-161-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-162-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-163-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-164-0x0000000005FF0000-0x0000000006056000-memory.dmp
memory/4936-152-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-166-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-167-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-168-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-169-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-170-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-171-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-172-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-173-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-174-0x0000000006640000-0x0000000006652000-memory.dmp
memory/4936-175-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-176-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-177-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-178-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-179-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-180-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-181-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-182-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-183-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-184-0x0000000077520000-0x00000000776AE000-memory.dmp
memory/4936-195-0x0000000006A30000-0x0000000006A6E000-memory.dmp