Analysis
- max time kernel
135s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230221-en - resource tags
- submitted
23/03/2023, 02:08
General
- Target bKJA.exe
- Size 348KB
- Sample230323-ckj9cach92
- SHA256 59917b4b4d1a67912f5896bfd274350cb4253cc2bf3c522781fda75ec72debf4
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
myhost88.ddns.net:4782
-
QSR_MUTEX_gBbXbVHlujwl4SvP3X
-
encryption_key
7Bgb3YgUbXKS2un5vbeM
-
install_name
ms configs.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
ms configs
-
subdirectory
SubDir
Signatures
- Quasar RAT 2 IoCs
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bKJA.exe"C:\Users\Admin\AppData\Local\Temp\bKJA.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4672-133-0x00000000001B0000-0x000000000020E000-memory.dmp
memory/4672-134-0x0000000005170000-0x0000000005714000-memory.dmp
memory/4672-135-0x0000000004D00000-0x0000000004D92000-memory.dmp
memory/4672-136-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4672-137-0x0000000004C60000-0x0000000004CC6000-memory.dmp
memory/4672-138-0x0000000005C20000-0x0000000005C32000-memory.dmp
memory/4672-139-0x0000000004C50000-0x0000000004C60000-memory.dmp
memory/4672-140-0x00000000067A0000-0x00000000067DC000-memory.dmp
memory/4672-141-0x00000000067E0000-0x00000000067EA000-memory.dmp