Analysis
- max time kernel
152s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/01/2023, 18:13
General
- Target aee53c247ee210c7a3189b41d117c71f0b962f49da436bf2c57e9934316e6070.exe
- Size 16.1MB
- Sample230129-wtqx2aaa2x
- SHA256 aee53c247ee210c7a3189b41d117c71f0b962f49da436bf2c57e9934316e6070
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
185.174.172.24:222
-
QSR_MUTEX_l4Q4az83wPO98KUwCA
-
encryption_key
rJLmSNNfkwxt1O20iBU6
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aee53c247ee210c7a3189b41d117c71f0b962f49da436bf2c57e9934316e6070.exe"C:\Users\Admin\AppData\Local\Temp\aee53c247ee210c7a3189b41d117c71f0b962f49da436bf2c57e9934316e6070.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5040-133-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-134-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-135-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-137-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-138-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-139-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-141-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-140-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-143-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-144-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-149-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-150-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-151-0x0000000000400000-0x00000000008CE000-memory.dmp
memory/5040-169-0x0000000074E40000-0x0000000074E92000-memory.dmp
memory/5040-173-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-174-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-175-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-172-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-177-0x0000000000400000-0x00000000008D8000-memory.dmp
memory/5040-178-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-179-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-180-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-181-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-182-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-183-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-176-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-184-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-185-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-186-0x0000000010000000-0x0000000010099000-memory.dmp
memory/5040-187-0x0000000072710000-0x0000000073B1E000-memory.dmp
memory/5040-188-0x0000000000400000-0x00000000008CE000-memory.dmp
memory/5040-189-0x0000000000400000-0x00000000008CE000-memory.dmp
memory/5040-190-0x00000000076E0000-0x0000000007C84000-memory.dmp
memory/5040-191-0x00000000011B0000-0x0000000001635000-memory.dmp
memory/5040-192-0x0000000071C20000-0x0000000072677000-memory.dmp
memory/5040-193-0x0000000008520000-0x00000000085B2000-memory.dmp
memory/5040-194-0x0000000071400000-0x0000000071C18000-memory.dmp
memory/5040-195-0x0000000007F20000-0x0000000007F86000-memory.dmp
memory/5040-196-0x0000000071350000-0x000000007135D000-memory.dmp
memory/5040-197-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-199-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-200-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-201-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-202-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-198-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-203-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-204-0x0000000071240000-0x0000000071309000-memory.dmp
memory/5040-205-0x0000000070F40000-0x0000000071214000-memory.dmp
memory/5040-206-0x00000000081E0000-0x00000000081F2000-memory.dmp
memory/5040-207-0x0000000070E30000-0x0000000070F35000-memory.dmp
memory/5040-208-0x00000000706B0000-0x0000000070E24000-memory.dmp
memory/5040-209-0x00000000084E0000-0x000000000851C000-memory.dmp
memory/5040-210-0x0000000000400000-0x00000000008D8000-memory.dmp
memory/5040-211-0x0000000000400000-0x00000000008D8000-memory.dmp
memory/5040-212-0x0000000008870000-0x000000000887A000-memory.dmp