Analysis
- max time kernel
43s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 13:10
General
- Target FIVEM-ESCROW-BYPASS-main/FXServer.exe
- Size 402KB
- Sample240417-qevpsagg56
- SHA256 7d0aef40fed4cadd574d950932844b19103cd82241067a89e3ecdd8da730d402
Malware Config
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FIVEM-ESCROW-BYPASS-main\FXServer.exe"C:\Users\Admin\AppData\Local\Temp\FIVEM-ESCROW-BYPASS-main\FXServer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "FXServer" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\FIVEM-ESCROW-BYPASS-main\FXServer.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\FXServer.exe"C:\Users\Admin\AppData\Roaming\SubDir\FXServer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "FXServer" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\FXServer.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
FXServer.exe.log
FXServer.exe
memory/3788-12-0x00007FFDCDD80000-0x00007FFDCE841000-memory.dmp
memory/3788-13-0x000000001BBC0000-0x000000001BBD0000-memory.dmp
memory/3788-17-0x00007FFDCDD80000-0x00007FFDCE841000-memory.dmp
memory/4476-0-0x0000000000200000-0x0000000000216000-memory.dmp
memory/4476-1-0x000000001AD00000-0x000000001ADAC000-memory.dmp
memory/4476-2-0x00007FFDCDD80000-0x00007FFDCE841000-memory.dmp
memory/4476-3-0x000000001AE70000-0x000000001AE80000-memory.dmp
memory/4476-4-0x00000000022D0000-0x00000000022E2000-memory.dmp
memory/4476-5-0x000000001ADF0000-0x000000001AE2C000-memory.dmp
memory/4476-14-0x00007FFDCDD80000-0x00007FFDCE841000-memory.dmp