Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
09/07/2023, 11:00
General
-
Target
16888128718a66611c1d86e12.exe
-
Size
348KB
-
MD5
7834a7e88c159e7f55934c740ca39935
-
SHA1
c5a4dcd4454df284e95472a972511c2488bd79ac
-
SHA256
b8eda4e9e691fe7017981cea833b63299ea6b89e08f3995b630cf705a393d16b
-
SHA512
2c3f4f70cb898eb6fafa60b8f55301ef4b3c1918c527bec6f8721c5146c4affef28bdabda991fdb799df78dc74d70af7d57989fb00dcb787e23a42ee851b4b7d
-
SSDEEP
6144:r2NHXf500MRWfu7waMmbUIgiWebh4OIqppWH5t5BW:yd50Ku8bNOSqpgH5/BW
Malware Config
Extracted
quasar
1.3.0.0
Office04
qrss.duckdns.org:54790
QSR_MUTEX_zlSKJvcuVjgb1gOk4J
-
encryption_key
vUOWxZSgsTmyyUM9Rgsw
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\16888128718a66611c1d86e12.exe"C:\Users\Admin\AppData\Local\Temp\16888128718a66611c1d86e12.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
40KB
-
Filesize
64KB