Analysis
- max time kernel
146s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/01/2024, 11:08
General
- Target 84d49466f2599b3ecc7cb706a04ae6924532b046fb9056e74fafddf6e332eea2.exe
- Size 4.7MB
- Sample240101-m8wmdshebj
- SHA256 84d49466f2599b3ecc7cb706a04ae6924532b046fb9056e74fafddf6e332eea2
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
frp.deitie.asia:5555
-
b827dda2-f30e-4465-be3c-2f1d6a93d4a7
-
encryption_key
465C04B3B0E08D663A071A4F330370E7A7DAD7A4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 5 IoCs
- Runs ping.exe 1 TTPs 14 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\84d49466f2599b3ecc7cb706a04ae6924532b046fb9056e74fafddf6e332eea2.exe"C:\Users\Admin\AppData\Local\Temp\84d49466f2599b3ecc7cb706a04ae6924532b046fb9056e74fafddf6e332eea2.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client_built.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\/Client_built.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7Idf1B99FxvA.bat" "4⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YyjPHJ7d97Fz.bat" "6⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rr2c79qi8cBL.bat" "8⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\crc8hDUP7RJl.bat" "10⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"11⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naklM1y3RtXE.bat" "12⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TGvLLrJXiCk1.bat" "14⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GXFKEnGfwA2g.bat" "16⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nJtYFSO1AnDF.bat" "18⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kFj5yWxcEjB2.bat" "20⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\X0NNPKKTI7sW.bat" "22⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\azBBItm3qRRQ.bat" "24⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7CDJfw2HOmld.bat" "26⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zmf2sQOWh89L.bat" "28⤵
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarmoiJOMmp8.bat" "30⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost1⤵
- Runs ping.exe
-
C:\Windows\system32\chcp.comchcp 650011⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client_built.exe
memory/944-34-0x00007FFE258F0000-0x00007FFE263B1000-memory.dmp
memory/944-40-0x00007FFE258F0000-0x00007FFE263B1000-memory.dmp
memory/944-35-0x0000000000DC0000-0x0000000000DD0000-memory.dmp
memory/1296-72-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/1296-66-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/1296-67-0x0000000003340000-0x0000000003350000-memory.dmp
memory/1556-6-0x000000001BD80000-0x000000001BD90000-memory.dmp
memory/1556-5-0x00007FFE25EC0000-0x00007FFE26981000-memory.dmp
memory/1556-13-0x00007FFE25EC0000-0x00007FFE26981000-memory.dmp
memory/1556-4-0x0000000000E10000-0x0000000001134000-memory.dmp
memory/2012-122-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/2012-128-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/2012-123-0x000000001B970000-0x000000001B980000-memory.dmp
memory/2324-50-0x00007FFE257D0000-0x00007FFE26291000-memory.dmp
memory/2324-56-0x00007FFE257D0000-0x00007FFE26291000-memory.dmp
memory/2324-51-0x0000000000CB0000-0x0000000000CC0000-memory.dmp
memory/2452-27-0x0000000002840000-0x0000000002850000-memory.dmp
memory/2452-26-0x00007FFE258F0000-0x00007FFE263B1000-memory.dmp
memory/2452-32-0x00007FFE258F0000-0x00007FFE263B1000-memory.dmp
memory/2680-106-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/2680-112-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/2680-107-0x00000000016B0000-0x00000000016C0000-memory.dmp
memory/2900-88-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/2900-83-0x00000000026A0000-0x00000000026B0000-memory.dmp
memory/2900-82-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/3020-99-0x000000001BB70000-0x000000001BB80000-memory.dmp
memory/3020-98-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/3020-104-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/3344-58-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/3344-64-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/3344-59-0x000000001B280000-0x000000001B290000-memory.dmp
memory/3564-131-0x000000001BBA0000-0x000000001BBB0000-memory.dmp
memory/4020-43-0x00000000026B0000-0x00000000026C0000-memory.dmp
memory/4020-48-0x00007FFE258F0000-0x00007FFE263B1000-memory.dmp
memory/4020-42-0x00007FFE258F0000-0x00007FFE263B1000-memory.dmp
memory/4376-75-0x0000000001A20000-0x0000000001A30000-memory.dmp
memory/4376-74-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/4376-80-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/4752-14-0x00007FFE25EC0000-0x00007FFE26981000-memory.dmp
memory/4752-15-0x000000001B2A0000-0x000000001B2B0000-memory.dmp
memory/4752-23-0x00007FFE25EC0000-0x00007FFE26981000-memory.dmp
memory/4752-16-0x000000001B740000-0x000000001B790000-memory.dmp
memory/4752-17-0x000000001B850000-0x000000001B902000-memory.dmp
memory/4976-119-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/4976-115-0x000000001B130000-0x000000001B140000-memory.dmp
memory/4976-114-0x00007FFE25890000-0x00007FFE26351000-memory.dmp
memory/4988-96-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/4988-90-0x00007FFE25770000-0x00007FFE26231000-memory.dmp
memory/4988-91-0x000000001BB00000-0x000000001BB10000-memory.dmp