Analysis
- max time kernel
147s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
30/08/2023, 13:54
General
- Target Hgcsjjjj.exe
- Size 348KB
- Sample230830-q7y8nsff79
- SHA256 bcf47f03f3a08fde57ea31b3b765a234ff97af23bb79b62141c8d25646a8cd8e
Malware Config
Extracted
-
quasar
-
1.0.0.0
-
Office04
-
157.90.253.169:6868
-
QSR_MUTEX_15vHaYq7FLBT0VTUCD
-
encryption_key
abHbiwakLvec90LTsGx0
-
install_name
scvhost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
scvhost
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hgcsjjjj.exe"C:\Users\Admin\AppData\Local\Temp\Hgcsjjjj.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "scvhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Hgcsjjjj.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\scvhost.exe"C:\Users\Admin\AppData\Roaming\SubDir\scvhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "scvhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\scvhost.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
scvhost.exe
scvhost.exe
memory/1812-4-0x00000000050E0000-0x00000000050F0000-memory.dmp
memory/1812-1-0x00000000005A0000-0x00000000005FE000-memory.dmp
memory/1812-0-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/1812-5-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/1812-6-0x0000000006010000-0x0000000006022000-memory.dmp
memory/1812-7-0x0000000006450000-0x000000000648C000-memory.dmp
memory/1812-2-0x00000000054E0000-0x0000000005A84000-memory.dmp
memory/1812-3-0x0000000004E80000-0x0000000004F12000-memory.dmp
memory/1812-14-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/4376-15-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/4376-16-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
memory/4376-18-0x0000000006670000-0x000000000667A000-memory.dmp
memory/4376-19-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/4376-20-0x0000000004CD0000-0x0000000004CE0000-memory.dmp