Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2023 20:42

General

  • Target

    dddd.exe

  • Size

    3.2MB

  • MD5

    58abd80cc431895f2c2126f714ca3c8c

  • SHA1

    9338c3bbe9e6dd3658848c03a5d3bcf02dfbe965

  • SHA256

    425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff

  • SHA512

    fcd8197173da2c475451f500cbea32b446d872a8553ebd76dae4ac3873ed8da149e8036cad65968f10d6719992e442e0ddfb458ce250c41521668d5117a14ec4

  • SSDEEP

    49152:S9GUKQbhUbLP/WdzmmVoNyQNKXVTHUt0ONKgDGsbolFjeTXbjuOvtXcUwowyr4T5:yUbLPudCfUj0t0ON/GUW6lJ3HdjX0

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

y20.ddns.net:5552

Mutex

081f9344-bbf0-4c0d-832c-1597fc2c5291

Attributes
  • encryption_key

    51E85A39CEAF3ACB23D073483E360B1A632697B4

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dddd.exe
    "C:\Users\Admin\AppData\Local\Temp\dddd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1876
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      #cmd
      2⤵
        PID:2300

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1408-1-0x00000000748E0000-0x0000000074FCE000-memory.dmp

      Filesize

      6.9MB

    • memory/1408-3-0x0000000000620000-0x0000000000660000-memory.dmp

      Filesize

      256KB

    • memory/1408-0-0x0000000000A00000-0x0000000000D2E000-memory.dmp

      Filesize

      3.2MB

    • memory/1408-17-0x0000000000620000-0x0000000000660000-memory.dmp

      Filesize

      256KB

    • memory/1408-16-0x00000000748E0000-0x0000000074FCE000-memory.dmp

      Filesize

      6.9MB

    • memory/1876-15-0x0000000070BF0000-0x000000007119B000-memory.dmp

      Filesize

      5.7MB

    • memory/1876-8-0x0000000070BF0000-0x000000007119B000-memory.dmp

      Filesize

      5.7MB

    • memory/1876-10-0x0000000070BF0000-0x000000007119B000-memory.dmp

      Filesize

      5.7MB

    • memory/1876-12-0x00000000025F0000-0x0000000002630000-memory.dmp

      Filesize

      256KB

    • memory/2300-6-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB

    • memory/2300-9-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB

    • memory/2300-14-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB

    • memory/2300-13-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB