Analysis
- max time kernel
153s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 02:43
General
- Target 5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3.exe
- Size 235KB
- Sample240327-c7jw4aah86
- SHA256 5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3
Malware Config
Extracted
-
quasar
-
1.4.0
-
Office04
-
103.200.29.109:1364
-
98fc1900-562b-44be-a417-23e5c6dd2639
-
encryption_key
4111EB4E3452F3046C6F5DFE90F84F08D3E1BB9C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of AdjustPrivilegeToken 63 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3.exe"C:\Users\Admin\AppData\Local\Temp\5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1711507519.exeC:\Users\Admin\AppData\Local\Temp/1711507519.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c whoami /groups2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami /groups3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.execmd.exe /c echo cseptr > \\.\pipe\cseptr1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
1711507519.exe
memory/1620-61-0x00007FF941710000-0x00007FF9420B1000-memory.dmp
memory/1620-63-0x000000001BA10000-0x000000001BB10000-memory.dmp
memory/1620-7-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1620-16-0x0000000002BF0000-0x0000000002DF0000-memory.dmp
memory/1620-17-0x0000000002DF0000-0x0000000002E5D000-memory.dmp
memory/1620-23-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1620-38-0x0000000000590000-0x00000000005B9000-memory.dmp
memory/1620-41-0x00000000029F0000-0x0000000002AF0000-memory.dmp
memory/1620-62-0x0000000002000000-0x0000000002010000-memory.dmp
memory/1620-46-0x0000000002BF0000-0x0000000002DF0000-memory.dmp
memory/1620-47-0x00000000029F0000-0x0000000002AF0000-memory.dmp
memory/1620-53-0x0000000000950000-0x0000000000982000-memory.dmp
memory/1620-56-0x00000000029F0000-0x0000000002AF0000-memory.dmp
memory/1620-59-0x0000000002F60000-0x0000000002F76000-memory.dmp
memory/1620-6-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1620-60-0x00007FF941710000-0x00007FF9420B1000-memory.dmp
memory/1620-45-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1620-0-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1620-64-0x0000000002000000-0x0000000002010000-memory.dmp
memory/1620-65-0x0000000000170000-0x00000000001B0000-memory.dmp
memory/1620-83-0x00000000029F0000-0x0000000002AF0000-memory.dmp
memory/1620-84-0x00007FF941710000-0x00007FF9420B1000-memory.dmp
memory/1620-88-0x0000000002000000-0x0000000002010000-memory.dmp
memory/1620-89-0x000000001BA10000-0x000000001BB10000-memory.dmp
memory/1620-94-0x0000000002000000-0x0000000002010000-memory.dmp
memory/1620-1-0x0000000140000000-0x000000014003D4D8-memory.dmp
memory/1712-103-0x0000000000320000-0x00000000003A4000-memory.dmp
memory/1712-105-0x00007FF93D7A0000-0x00007FF93E261000-memory.dmp
memory/1712-106-0x000000001B080000-0x000000001B090000-memory.dmp
memory/1712-110-0x0000000002530000-0x0000000002580000-memory.dmp
memory/1712-112-0x000000001B450000-0x000000001B502000-memory.dmp
memory/1712-132-0x00007FF93D7A0000-0x00007FF93E261000-memory.dmp