Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
26/03/2024, 02:14
General
- Target 5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3.exe
- Size 235KB
- Sample240326-cpffysbg64
- SHA256 5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3
Malware Config
Extracted
-
quasar
-
1.4.0
-
Office04
-
103.200.29.109:1364
-
98fc1900-562b-44be-a417-23e5c6dd2639
-
encryption_key
4111EB4E3452F3046C6F5DFE90F84F08D3E1BB9C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects executables containing common artifacts observed in infostealers 2 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3.exe"C:\Users\Admin\AppData\Local\Temp\5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1711419415.exeC:\Users\Admin\AppData\Local\Temp/1711419415.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c whoami /groups2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami /groups3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c echo mheuis > \\.\pipe\mheuis1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
1711419415.exe
memory/1108-42-0x00000000029B0000-0x0000000002AB0000-memory.dmp
memory/1108-131-0x0000000002FF0000-0x0000000003000000-memory.dmp
memory/1108-7-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1108-16-0x0000000002DB0000-0x0000000002E1D000-memory.dmp
memory/1108-18-0x0000000002BB0000-0x0000000002DB0000-memory.dmp
memory/1108-23-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1108-38-0x0000000000890000-0x00000000008B9000-memory.dmp
memory/1108-1-0x0000000140000000-0x000000014003D4D8-memory.dmp
memory/1108-45-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1108-46-0x0000000002BB0000-0x0000000002DB0000-memory.dmp
memory/1108-47-0x00000000029B0000-0x0000000002AB0000-memory.dmp
memory/1108-175-0x000000001B8E0000-0x000000001B9E0000-memory.dmp
memory/1108-171-0x0000000002FF0000-0x0000000003000000-memory.dmp
memory/1108-126-0x00000000029B0000-0x0000000002AB0000-memory.dmp
memory/1108-6-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1108-129-0x0000000002F70000-0x0000000002F86000-memory.dmp
memory/1108-133-0x000000001B8E0000-0x000000001B9E0000-memory.dmp
memory/1108-132-0x00007FFA00200000-0x00007FFA00BA1000-memory.dmp
memory/1108-130-0x00007FFA00200000-0x00007FFA00BA1000-memory.dmp
memory/1108-134-0x0000000002FF0000-0x0000000003000000-memory.dmp
memory/1108-150-0x00000000029B0000-0x0000000002AB0000-memory.dmp
memory/1108-151-0x00007FFA00200000-0x00007FFA00BA1000-memory.dmp
memory/1108-156-0x0000000002FF0000-0x0000000003000000-memory.dmp
memory/1108-0-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1832-172-0x00000000004A0000-0x0000000000524000-memory.dmp
memory/1832-174-0x00007FF9FC8C0000-0x00007FF9FD381000-memory.dmp
memory/1832-178-0x00000000026B0000-0x0000000002700000-memory.dmp
memory/1832-179-0x000000001B5D0000-0x000000001B682000-memory.dmp
memory/1832-200-0x00007FF9FC8C0000-0x00007FF9FD381000-memory.dmp
memory/3404-66-0x000002139A240000-0x000002139A250000-memory.dmp
memory/3404-50-0x000002139A140000-0x000002139A150000-memory.dmp