Analysis

  • max time kernel
    32s
  • max time network
    27s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    18-04-2024 21:56

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    2c1fba8d6624adf6c582fb2d5fb43b28

  • SHA1

    bd45ee984e9476d604824f83c6cf6111a9db2467

  • SHA256

    a5473ea4c4ef75c217e0d252d1c7d235b781a75810b7e731a97ed78b45646840

  • SHA512

    cc85b5f1c2765c49f34c236634dcbfdfd6cc62e0b954b74c12b0d89dc29044dff88a9840e5c02a39e140564283074c78359dd70dfc7f426daefb75f195f14e19

  • SSDEEP

    49152:nvVG42pda6D+/PjlLOlg6yQipV6iRJ67bR3LoGdTqTHHB72eh2NT:nvM42pda6D+/PjlLOlZyQipV6iRJ6ND

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

funlink.ddns.net:4444

quasarhost1.ddns.net:4444

Mutex

c363b2f8-fc6a-4abd-a753-cff1aad2a173

Attributes
  • encryption_key

    CE5FBAC1A56C8C780C74FE8E7CD5CBCF8ABD6C8D

  • install_name

    updale.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    windows av startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:340
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1716
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2552

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/340-0-0x0000000000860000-0x0000000000B84000-memory.dmp

      Filesize

      3.1MB

    • memory/340-1-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

      Filesize

      9.9MB

    • memory/340-2-0x0000000000300000-0x0000000000380000-memory.dmp

      Filesize

      512KB

    • memory/340-4-0x000007FEF52B0000-0x000007FEF5C9C000-memory.dmp

      Filesize

      9.9MB

    • memory/340-5-0x0000000000300000-0x0000000000380000-memory.dmp

      Filesize

      512KB