Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 06:06

General

  • Target

    24e7acb706dffb37b3e682424719f5ab.exe

  • Size

    3.1MB

  • MD5

    24e7acb706dffb37b3e682424719f5ab

  • SHA1

    5d4864f3acb3076ee4005990114a4a1f2520d456

  • SHA256

    0972bb0ba1caff7adc92bb35f645b5e0d825fa74fb1b76ff822dce8c200ab30d

  • SHA512

    3d4b62d8a2c725f288277a0021c5dc46600e71b20fcdc660fdb00e0d37ff0a0114b7571d331fd85f989da74ef2dbf57add61b90085ff94cf53f5d07fea215c50

  • SSDEEP

    49152:HvilL26AaNeWgPhlmVqvMQ7XSKE6kjn+DixoGgBoTHHB72eh2NT:HvaL26AaNeWgPhlmVqkQ7XSKExn+DS

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Kneegrowless-33547.portmap.host:33547

Mutex

10674f25-f575-4b14-92cf-06a7073df875

Attributes
  • encryption_key

    E5427EE2BE27EB8DFAE76384CABC8A5EBB33EB00

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24e7acb706dffb37b3e682424719f5ab.exe
    "C:\Users\Admin\AppData\Local\Temp\24e7acb706dffb37b3e682424719f5ab.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4580-0-0x0000000000E70000-0x0000000001194000-memory.dmp

    Filesize

    3.1MB

  • memory/4580-1-0x00007FF823C90000-0x00007FF824751000-memory.dmp

    Filesize

    10.8MB

  • memory/4580-2-0x000000001BDB0000-0x000000001BDC0000-memory.dmp

    Filesize

    64KB

  • memory/4580-3-0x000000001C460000-0x000000001C4B0000-memory.dmp

    Filesize

    320KB

  • memory/4580-4-0x000000001C570000-0x000000001C622000-memory.dmp

    Filesize

    712KB

  • memory/4580-7-0x000000001C4F0000-0x000000001C502000-memory.dmp

    Filesize

    72KB

  • memory/4580-8-0x000000001CE70000-0x000000001CEAC000-memory.dmp

    Filesize

    240KB

  • memory/4580-9-0x00007FF823C90000-0x00007FF824751000-memory.dmp

    Filesize

    10.8MB

  • memory/4580-10-0x000000001BDB0000-0x000000001BDC0000-memory.dmp

    Filesize

    64KB