Analysis
- max time kernel
67s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
25/02/2023, 17:30
General
- Target 0x002000000000f683-57.exe
- Size 289KB
- Sample230225-v3eexsdf7t
- SHA256 ed1545bda10c94c007b0d75b7895d10548fa096ba1b984b519737dfc6f307f3a
Malware Config
Extracted
-
quasar
-
1.4.0.0
-
Office04
-
67.213.221.18:7812
-
KFoYp486ql6lO6U0qI
-
encryption_key
OtItMK9boIZNOQTejUzg
-
install_name
Windows Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
Windows Services
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x002000000000f683-57.exe"C:\Users\Admin\AppData\Local\Temp\0x002000000000f683-57.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\0x002000000000f683-57.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\Windows Services\Windows Security.exe"C:\Users\Admin\AppData\Roaming\Windows Services\Windows Security.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Services\Windows Security.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Windows Security.exe
Windows Security.exe
memory/1788-133-0x0000000000260000-0x00000000002AE000-memory.dmp
memory/1788-134-0x0000000005310000-0x00000000058B4000-memory.dmp
memory/1788-135-0x0000000004C60000-0x0000000004CF2000-memory.dmp
memory/1788-136-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/1788-137-0x0000000004E60000-0x0000000004EC6000-memory.dmp
memory/1788-138-0x00000000052D0000-0x00000000052E2000-memory.dmp
memory/1788-139-0x0000000005EC0000-0x0000000005EFC000-memory.dmp
memory/1936-146-0x0000000005410000-0x0000000005420000-memory.dmp
memory/1936-148-0x0000000006810000-0x000000000681A000-memory.dmp
memory/1936-149-0x0000000005410000-0x0000000005420000-memory.dmp