Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/01/2024, 08:34
General
- Target Client.exe
- Size 3.1MB
- Sample240122-kge48accdn
- SHA256 4e6e48275b1f3412edc045e1a81d509ddcfe360c06bdd4483fcd5b4fc77b7ef3
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
192.168.99.110:1234
-
5c4c76ec-d876-4460-a1c2-968301016566
-
encryption_key
DC1BC720780098E2E7EE679576CF3FD45D13DD0A
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe.log
Client.exe
Client.exe
memory/2232-10-0x00007FFFBF2C0000-0x00007FFFBFD81000-memory.dmp
memory/2232-2-0x000000001B4D0000-0x000000001B4E0000-memory.dmp
memory/2232-1-0x00007FFFBF2C0000-0x00007FFFBFD81000-memory.dmp
memory/2232-0-0x0000000000420000-0x0000000000744000-memory.dmp
memory/4208-11-0x00007FFFBF2C0000-0x00007FFFBFD81000-memory.dmp
memory/4208-12-0x000000001BD20000-0x000000001BD30000-memory.dmp
memory/4208-13-0x00000000031D0000-0x0000000003220000-memory.dmp
memory/4208-14-0x000000001DC90000-0x000000001DD42000-memory.dmp
memory/4208-15-0x00007FFFBF2C0000-0x00007FFFBFD81000-memory.dmp
memory/4208-16-0x000000001BD20000-0x000000001BD30000-memory.dmp