Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
21/01/2024, 10:27
General
- Target Client-built.exe
- Size 3.1MB
- Sample240121-mhg2babbdp
- SHA256 96a983cc617274e4b31fc48376076730f94938e11a1964b047078a85e319de4d
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
192.168.237.58:4782
-
7e92d715-0d34-4e03-b437-208898a57cfe
-
encryption_key
B8B2E48704D52B41FBA72A9D041B0E00C0272F4C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3516-7-0x0000014D17060000-0x0000014D17070000-memory.dmp
memory/3516-43-0x0000014D1F610000-0x0000014D1F611000-memory.dmp
memory/3516-42-0x0000014D1F500000-0x0000014D1F501000-memory.dmp
memory/3516-41-0x0000014D1F500000-0x0000014D1F501000-memory.dmp
memory/3516-39-0x0000014D1F4D0000-0x0000014D1F4D1000-memory.dmp
memory/3516-23-0x0000014D17160000-0x0000014D17170000-memory.dmp
memory/4328-3-0x000000001BB60000-0x000000001BBB0000-memory.dmp
memory/4328-6-0x0000000002810000-0x0000000002820000-memory.dmp
memory/4328-5-0x00007FFC16F50000-0x00007FFC17A11000-memory.dmp
memory/4328-4-0x000000001BC70000-0x000000001BD22000-memory.dmp
memory/4328-0-0x0000000000340000-0x0000000000664000-memory.dmp
memory/4328-2-0x0000000002810000-0x0000000002820000-memory.dmp
memory/4328-1-0x00007FFC16F50000-0x00007FFC17A11000-memory.dmp