Analysis
- max time kernel
217s - max time network
233s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
13/10/2023, 05:06
General
- Target b584210f26cf4eadf5593e767c78b916.exe
- Size 3.5MB
- Sample231013-freh8agh62
- SHA256 e1fb148206beb7168a5f92581a51ea32a03d841abf00aff221f35ed03197a59d
Malware Config
Extracted
-
quasar
-
1.4.1
-
Cashing
-
185.17.0.246:1419
-
e32b7ac6-a9bd-4f6a-a9c2-2187fa77e95c
-
encryption_key
CE9D5068446A3372A70ABE8EBD0D7F0CBC814B08
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 20 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b584210f26cf4eadf5593e767c78b916.exe"C:\Users\Admin\AppData\Local\Temp\b584210f26cf4eadf5593e767c78b916.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text3⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_30r0edn4.rnh.ps1
memory/1000-6-0x00007FFF08230000-0x00007FFF08CF1000-memory.dmp
memory/1000-21-0x00007FFF08230000-0x00007FFF08CF1000-memory.dmp
memory/1000-18-0x00000215FC400000-0x00000215FC410000-memory.dmp
memory/1000-17-0x00000215FC410000-0x00000215FC432000-memory.dmp
memory/1000-7-0x00000215FC400000-0x00000215FC410000-memory.dmp
memory/1304-4-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp
memory/1304-5-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp
memory/1304-0-0x000001DA4E400000-0x000001DA4E736000-memory.dmp
memory/1304-3-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp
memory/1304-2-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp
memory/1304-1-0x00007FFF08230000-0x00007FFF08CF1000-memory.dmp
memory/1304-23-0x00007FFF08230000-0x00007FFF08CF1000-memory.dmp
memory/1304-24-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp
memory/1304-25-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp
memory/1304-26-0x000001DA33DA0000-0x000001DA33DB0000-memory.dmp