Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 19:49
General
- Target ORBITCracked.exe
- Size 3.1MB
- Sample240328-yjs1raff75
- SHA256 f1360aa4d9adeff9ccff753f2996be1b827d7bc3a79549cc6635346ce3eb1da2
Malware Config
Extracted
-
quasar
-
1.4.1
-
Slave
-
140.238.91.110:38899
-
uk2.localto.net:38899:38899
-
276d9dc6-b19c-4958-8ac3-89586bd3b515
-
encryption_key
ABCF70C37D1A79A01712038122D1532DF20DF72A
-
install_name
Client.exe
-
log_directory
Error Logs
-
reconnect_delay
3000
-
startup_key
WOS64
-
subdirectory
Windows
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORBITCracked.exe"C:\Users\Admin\AppData\Local\Temp\ORBITCracked.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WOS64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\Windows\Client.exe"C:\Users\Admin\AppData\Roaming\Windows\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "WOS64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
AssertSkip.pub
CompareDisable.vsw
DisconnectCompress.aiff
FindWrite.php
GetBlock.css
GetGroup.inf
GrantApprove.aifc
LimitResume.vstm
MergeUndo.xlsx
Microsoft Edge.lnk
MountDisable.dib
OutFormat.vstm
PingWait.mpe
PopGroup.svgz
RegisterHide.mpv2
SendPing.WTV
SetSuspend.WTV
ShowCompare.dotm
StopConvertTo.lock
SubmitConvertTo.TTS
SyncRedo.3g2
UnblockStart.csv
UpdateBackup.fon
UseOpen.doc
WaitConvert.raw
Acrobat Reader DC.lnk
Firefox.lnk
Google Chrome.lnk
VLC media player.lnk
memory/3000-16-0x000000001C2A0000-0x000000001C2B2000-memory.dmp
memory/3000-21-0x000000001B770000-0x000000001B780000-memory.dmp
memory/3000-20-0x00007FF99B3A0000-0x00007FF99BE61000-memory.dmp
memory/3000-18-0x000000001C940000-0x000000001CA42000-memory.dmp
memory/3000-17-0x000000001C300000-0x000000001C33C000-memory.dmp
memory/3000-13-0x000000001C340000-0x000000001C3F2000-memory.dmp
memory/3000-12-0x000000001B6D0000-0x000000001B720000-memory.dmp
memory/3000-11-0x000000001B770000-0x000000001B780000-memory.dmp
memory/3000-10-0x00007FF99B3A0000-0x00007FF99BE61000-memory.dmp
memory/4504-0-0x0000000000FA0000-0x00000000012C4000-memory.dmp
memory/4504-9-0x00007FF99B3A0000-0x00007FF99BE61000-memory.dmp
memory/4504-2-0x000000001BF90000-0x000000001BFA0000-memory.dmp
memory/4504-1-0x00007FF99B3A0000-0x00007FF99BE61000-memory.dmp