Analysis
- max time kernel
146s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/04/2024, 12:12
General
- Target quaser.exe
- Size 506KB
- Sample240401-pc8cesef36
- SHA256 cf9ef2af812e7e3fe4ce9d1f875279110f318d678c5f053e5d767b02eadc2694
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
welcome
-
185.144.28.50:8080
-
80.85.154.22:8080
-
QSR_MUTEX_KOCkZ8aUXzJpoMsKnJ
-
encryption_key
y4kgXabXHGVPR1ljHctQ
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\quaser.exe"C:\Users\Admin\AppData\Local\Temp\quaser.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/4688-14-0x0000000000830000-0x000000000088E000-memory.dmp
memory/4688-15-0x0000000072980000-0x0000000073130000-memory.dmp
memory/4688-16-0x00000000057E0000-0x0000000005D84000-memory.dmp
memory/4688-17-0x0000000005230000-0x00000000052C2000-memory.dmp
memory/4688-18-0x0000000005180000-0x0000000005190000-memory.dmp
memory/4688-19-0x0000000005190000-0x00000000051F6000-memory.dmp
memory/4688-20-0x00000000057B0000-0x00000000057C2000-memory.dmp
memory/4688-21-0x00000000063B0000-0x00000000063EC000-memory.dmp
memory/4688-27-0x0000000072980000-0x0000000073130000-memory.dmp
memory/5028-28-0x0000000072980000-0x0000000073130000-memory.dmp
memory/5028-29-0x0000000005940000-0x0000000005950000-memory.dmp
memory/5028-30-0x0000000072980000-0x0000000073130000-memory.dmp
memory/5028-31-0x0000000006C90000-0x0000000006C9A000-memory.dmp
memory/5028-32-0x0000000005940000-0x0000000005950000-memory.dmp