Resubmissions
11/11/2023, 23:21
231111-3bzwjscf8323/10/2023, 06:49
231023-hlwawsgf5223/10/2023, 06:44
231023-hhztxagf431023/10/2023, 01:43
231023-b4865sde8y1023/10/2023, 01:37
231023-b2a7bsde8t1023/10/2023, 00:24
231023-ap5pqsdd611023/10/2023, 00:16
231023-akm9wsdd5y1023/10/2023, 00:09
231023-affdgsdd5s1023/10/2023, 00:08
231023-afbqasfc4723/10/2023, 00:04
231023-acqp2sdd3x10Analysis
- max time kernel
5s - max time network
23s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
23/10/2023, 00:24
General
- Target GraveYard.Client/mods/configs/client.exe
- Size 3.1MB
- Sample231023-ap5pqsdd61
- SHA256 8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
Score
10/10
Malware Config
Extracted
Family
-
quasar
Attributes
-
reconnect_delay
5000
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe"C:\Users\Admin\AppData\Local\Temp\GraveYard.Client\mods\configs\client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4188-0-0x0000000000CB0000-0x0000000000FDA000-memory.dmp
memory/4188-1-0x00007FFE289E0000-0x00007FFE294A1000-memory.dmp
memory/4188-2-0x00000000017A0000-0x00000000017B0000-memory.dmp
memory/4188-4-0x00007FFE289E0000-0x00007FFE294A1000-memory.dmp