Analysis
- max time kernel
143s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/03/2024, 02:29
General
- Target 83d1e736a793ba5d14b51f8ef8310bf13a2591fc40ad34d1fa3e74acf5d40c70.exe
- Size 3.1MB
- Sample240307-cys4eadd26
- SHA256 83d1e736a793ba5d14b51f8ef8310bf13a2591fc40ad34d1fa3e74acf5d40c70
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
209.182.234.69:5000
-
1d7ed661-c682-43f5-973b-fc9bfdbd96a8
-
encryption_key
ABD5B6E1498842B0D7FFC59005525F3510E9622D
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83d1e736a793ba5d14b51f8ef8310bf13a2591fc40ad34d1fa3e74acf5d40c70.exe"C:\Users\Admin\AppData\Local\Temp\83d1e736a793ba5d14b51f8ef8310bf13a2591fc40ad34d1fa3e74acf5d40c70.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4756-0-0x0000000000E90000-0x00000000011B4000-memory.dmp
memory/4756-1-0x00007FFB76AA0000-0x00007FFB77561000-memory.dmp
memory/4756-2-0x000000001BE20000-0x000000001BE30000-memory.dmp
memory/4756-3-0x000000001CCB0000-0x000000001CD00000-memory.dmp
memory/4756-4-0x000000001CDC0000-0x000000001CE72000-memory.dmp
memory/4756-7-0x000000001CD00000-0x000000001CD12000-memory.dmp
memory/4756-8-0x000000001CD60000-0x000000001CD9C000-memory.dmp
memory/4756-9-0x00007FFB76AA0000-0x00007FFB77561000-memory.dmp
memory/4756-10-0x000000001BE20000-0x000000001BE30000-memory.dmp