Analysis
- max time kernel
133s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
04/03/2023, 17:32
General
- Target testy.exe
- Size 348KB
- Sample230304-v4nd8adh2x
- SHA256 8fc09b94cb97656101a274554d86c1f4f81a1a4e498b17396f7385e77750356c
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
life-chase.at.ply.gg:24297
-
QSR_MUTEX_n0f6at7YDD5llBKKrq
-
encryption_key
GXr7FvcJDB19xszfi7lK
-
install_name
Protect.exe
-
log_directory
Logs
-
reconnect_delay
30
-
startup_key
MS Protect
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\testy.exe"C:\Users\Admin\AppData\Local\Temp\testy.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "MS Protect" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\testy.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Protect.exe"C:\Users\Admin\AppData\Roaming\SubDir\Protect.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "MS Protect" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Protect.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Protect.exe
Protect.exe
memory/4548-133-0x00000000006D0000-0x000000000072E000-memory.dmp
memory/4548-134-0x0000000005700000-0x0000000005CA4000-memory.dmp
memory/4548-135-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/4548-136-0x0000000005040000-0x0000000005050000-memory.dmp
memory/4548-137-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/4548-138-0x0000000005FD0000-0x0000000005FE2000-memory.dmp
memory/4548-139-0x0000000006400000-0x000000000643C000-memory.dmp
memory/4772-146-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/4772-147-0x0000000006870000-0x000000000687A000-memory.dmp
memory/4772-148-0x0000000004F40000-0x0000000004F50000-memory.dmp