Analysis
- max time kernel
151s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
12/03/2024, 01:12
General
- Target tmp.exe
- Size 3.1MB
- Sample240312-bkpcmadf95
- SHA256 83d1e736a793ba5d14b51f8ef8310bf13a2591fc40ad34d1fa3e74acf5d40c70
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
209.182.234.69:5000
Mutex
-
1d7ed661-c682-43f5-973b-fc9bfdbd96a8
Attributes
-
encryption_key
ABD5B6E1498842B0D7FFC59005525F3510E9622D
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4580-0-0x00000000005D0000-0x00000000008F4000-memory.dmp
memory/4580-1-0x00007FF893BF0000-0x00007FF8946B1000-memory.dmp
memory/4580-2-0x0000000002AD0000-0x0000000002AE0000-memory.dmp
memory/4580-3-0x000000001BFF0000-0x000000001C040000-memory.dmp
memory/4580-4-0x000000001C100000-0x000000001C1B2000-memory.dmp
memory/4580-5-0x00007FF893BF0000-0x00007FF8946B1000-memory.dmp
memory/4580-6-0x0000000002AD0000-0x0000000002AE0000-memory.dmp