Behavioral task
behavioral1
Sample
2304-203-0x0000000000400000-0x0000000000724000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2304-203-0x0000000000400000-0x0000000000724000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2304-203-0x0000000000400000-0x0000000000724000-memory.dmp
-
Size
3.1MB
-
MD5
f053b0ff24d89693c90409b6d4b36eb3
-
SHA1
1eded4d02b5e40354e3966403884f2f69b307492
-
SHA256
cc2ca8313e32b174ffe94d79bbdb19725d777ea77de8f4896eb90c6aeb5801ed
-
SHA512
425724493e5af4627cc688434bc82979dc7b61b0daa2544c4bf2f39a37f2b9e92d49a5c28c08d07fc95b11d8d84d7c43f7dcbc4e2c5834a3cbbd37816749047a
-
SSDEEP
49152:GvbI22SsaNYfdPBldt698dBcjHxCz1JFLoGdnTHHB72eh2NT:Gvk22SsaNYfdPBldt6+dBcjHxC5
Malware Config
Extracted
quasar
1.4.1
Office04
139.99.114.150:4782
5d00609e-0fa1-420e-ae32-932ac5f0d8a0
-
encryption_key
353F228C32E13DAE9184FE5306B840EBAF1CD966
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2304-203-0x0000000000400000-0x0000000000724000-memory.dmp
Files
-
2304-203-0x0000000000400000-0x0000000000724000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ