Analysis
- max time kernel
3s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/01/2024, 08:09
General
- Target 82dfd095c6d9f8e5e206e74d9717c0e5311d88906b7305052b3d9e5566ed1f83.exe
- Size 4.2MB
- Sample240101-j2avkaefcn
- SHA256 82dfd095c6d9f8e5e206e74d9717c0e5311d88906b7305052b3d9e5566ed1f83
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
frp.deitie.asia:5555
-
b827dda2-f30e-4465-be3c-2f1d6a93d4a7
-
encryption_key
465C04B3B0E08D663A071A4F330370E7A7DAD7A4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 5 IoCs
- Runs ping.exe 1 TTPs 13 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82dfd095c6d9f8e5e206e74d9717c0e5311d88906b7305052b3d9e5566ed1f83.exe"C:\Users\Admin\AppData\Local\Temp\82dfd095c6d9f8e5e206e74d9717c0e5311d88906b7305052b3d9e5566ed1f83.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client_built.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\/Client_built.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\weELfXz2wj6S.bat" "4⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eyHfWoQFcasa.bat" "6⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pGue22rFGByC.bat" "8⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCtwQ338TvBR.bat" "10⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"11⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U5NcMZsGQWEQ.bat" "12⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NnDAiKAvi3yQ.bat" "14⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kATzxf3wHgvh.bat" "16⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TVW8ZHyq02EI.bat" "18⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- Runs ping.exe
-
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CMS84SMQkz65.bat" "20⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dl3NytsRc7h4.bat" "22⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CyA1oTzy6Fdn.bat" "24⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PMj1Mafq3mGs.bat" "26⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aa09wmrVcAD0.bat" "28⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"29⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client_built.exe
memory/752-80-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/752-74-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/752-75-0x0000000000BC0000-0x0000000000BD0000-memory.dmp
memory/1380-40-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/1380-34-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/1380-35-0x000000001B370000-0x000000001B380000-memory.dmp
memory/1980-32-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/1980-25-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/1980-27-0x000000001BDE0000-0x000000001BDF0000-memory.dmp
memory/2924-82-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/2924-83-0x000000001B1A0000-0x000000001B1B0000-memory.dmp
memory/2924-88-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/3020-113-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/3020-114-0x000000001B510000-0x000000001B520000-memory.dmp
memory/3020-118-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/3184-42-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/3184-43-0x000000001B050000-0x000000001B060000-memory.dmp
memory/3184-48-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/3276-5-0x00007FFBE3320000-0x00007FFBE3DE1000-memory.dmp
memory/3276-6-0x000000001BB50000-0x000000001BB60000-memory.dmp
memory/3276-26-0x00007FFBE3320000-0x00007FFBE3DE1000-memory.dmp
memory/3276-4-0x0000000000BD0000-0x0000000000EF4000-memory.dmp
memory/3364-105-0x00007FFBE22A0000-0x00007FFBE2D61000-memory.dmp
memory/3364-111-0x00007FFBE22A0000-0x00007FFBE2D61000-memory.dmp
memory/3364-106-0x000000001B410000-0x000000001B420000-memory.dmp
memory/4116-15-0x000000001C0B0000-0x000000001C100000-memory.dmp
memory/4116-16-0x000000001C400000-0x000000001C4B2000-memory.dmp
memory/4116-14-0x000000001C130000-0x000000001C140000-memory.dmp
memory/4116-13-0x00007FFBE3320000-0x00007FFBE3DE1000-memory.dmp
memory/4116-22-0x00007FFBE3320000-0x00007FFBE3DE1000-memory.dmp
memory/4248-72-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/4248-103-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/4248-66-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/4248-67-0x000000001B7C0000-0x000000001B7D0000-memory.dmp
memory/4248-98-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/4332-122-0x000000001B930000-0x000000001B940000-memory.dmp
memory/4332-121-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/4592-90-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/4592-95-0x00007FFBE2870000-0x00007FFBE3331000-memory.dmp
memory/4592-91-0x000000001BEB0000-0x000000001BEC0000-memory.dmp
memory/4872-56-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/4872-51-0x000000001B290000-0x000000001B2A0000-memory.dmp
memory/4872-50-0x00007FFBE2B30000-0x00007FFBE35F1000-memory.dmp
memory/5112-64-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp
memory/5112-59-0x000000001BDE0000-0x000000001BDF0000-memory.dmp
memory/5112-58-0x00007FFBE27C0000-0x00007FFBE3281000-memory.dmp