Analysis
- max time kernel
148s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
19/12/2023, 16:50
General
- Target 61d8551b55b55b3d929e2281362b9513.exe
- Size 1.3MB
- Sample231219-vcc46sbac3
- SHA256 61ac9f591b1d67f0c954049d2e6d15cebf213055d6ed6ee0cada7a1f295b1b96
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
0.tcp.ngrok.io:14530
-
QSR_MUTEX_w8Mfgcdxl7hldMH2pY
-
encryption_key
zYcujUQPEU4C2FHrr1HG
-
install_name
Diciple Cheats Loader-Protected.exe
-
log_directory
Key Strokes
-
reconnect_delay
3000
-
startup_key
svhost.exe
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 4 IoCs
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 41 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61d8551b55b55b3d929e2281362b9513.exe"C:\Users\Admin\AppData\Local\Temp\61d8551b55b55b3d929e2281362b9513.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svhost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\61d8551b55b55b3d929e2281362b9513.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\SubDir\Diciple Cheats Loader-Protected.exe"C:\Windows\SysWOW64\SubDir\Diciple Cheats Loader-Protected.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svhost.exe" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Diciple Cheats Loader-Protected.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Diciple Cheats Loader-Protected.exe
memory/3100-20-0x0000000000BB0000-0x0000000000FB0000-memory.dmp
memory/3100-18-0x0000000000BB0000-0x0000000000FB0000-memory.dmp
memory/3100-29-0x0000000006F10000-0x0000000006F20000-memory.dmp
memory/3100-28-0x0000000074340000-0x0000000074AF0000-memory.dmp
memory/3100-26-0x0000000000BB0000-0x0000000000FB0000-memory.dmp
memory/3100-24-0x00000000086D0000-0x00000000086DA000-memory.dmp
memory/3100-22-0x0000000006F10000-0x0000000006F20000-memory.dmp
memory/3100-19-0x0000000074340000-0x0000000074AF0000-memory.dmp
memory/3100-13-0x0000000000BB0000-0x0000000000FB0000-memory.dmp
memory/4932-2-0x0000000074340000-0x0000000074AF0000-memory.dmp
memory/4932-1-0x0000000001000000-0x0000000001400000-memory.dmp
memory/4932-8-0x0000000008830000-0x000000000886C000-memory.dmp
memory/4932-17-0x0000000001000000-0x0000000001400000-memory.dmp
memory/4932-21-0x0000000074340000-0x0000000074AF0000-memory.dmp
memory/4932-0-0x0000000001000000-0x0000000001400000-memory.dmp
memory/4932-7-0x0000000008410000-0x0000000008422000-memory.dmp
memory/4932-6-0x00000000074B0000-0x0000000007516000-memory.dmp
memory/4932-5-0x0000000007520000-0x0000000007530000-memory.dmp
memory/4932-4-0x0000000007410000-0x00000000074A2000-memory.dmp
memory/4932-3-0x00000000078A0000-0x0000000007E44000-memory.dmp