Resubmissions
25/08/2025, 18:11
250825-wswrwszr1227/04/2024, 16:11
240427-tmy9qadd7t1027/04/2024, 12:22
240427-pj8a1aba5t10Analysis
- max time kernel
49s - max time network
16s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
- submitted
27/04/2024, 12:22
General
- Target SeroXen.exe
- Size 38.6MB
- Sample240427-pj8a1aba5t
- SHA256 7cb37cd110a388998ce95819da915446331f614a5da8d5cfeed953812ada23f1
Malware Config
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 1 IoCs
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SeroXen.exe"C:\Users\Admin\AppData\Local\Temp\SeroXen.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1740 -s 6042⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
C5VM64.dll
memory/1740-0-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp
memory/1740-1-0x0000000000C40000-0x00000000032D4000-memory.dmp
memory/1740-2-0x0000000000BC0000-0x0000000000C40000-memory.dmp
memory/1740-9-0x000007FEF25E0000-0x000007FEF2E3F000-memory.dmp
memory/1740-10-0x000007FEF25E0000-0x000007FEF2E3F000-memory.dmp
memory/1740-11-0x0000000077C40000-0x0000000077DE9000-memory.dmp
memory/1740-12-0x000007FEF4BC0000-0x000007FEF4CEC000-memory.dmp
memory/1740-13-0x000007FEF25E0000-0x000007FEF2E3F000-memory.dmp
memory/1740-14-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp
memory/1740-15-0x0000000077C40000-0x0000000077DE9000-memory.dmp