Overview

overview

10

Static

static

3

Client.exe

windows7-x64

10

Client.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 11:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    169KB

  • MD5

    25291bd76d119ddc6eb07f2fe2fa3488

  • SHA1

    306fbacaf20e9cf43caa3d59e5a0a859932b6652

  • SHA256

    14f9d6d20222a1b9824dd22e6173731b934dfbf1670f8228f740a8a2e3b824f0

  • SHA512

    031ae88bf3b88cd602bbb8a1dbc313d5ce1317cf390116b3115a44e5990e06abdaaa72c8f81f6e63ffe9af78edf36c1dc18d4f5f044143518e8f9e94d14b5706

  • SSDEEP

    3072:NJgG6EsvKxZfa4kDoYuw1bm+cKc8Beaim9bArt1GwSYvTwel:Q1EsIZfaR/K8him9bct1

Score
10/10
quasarspywaretrojan

Malware Config

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1732-1-0x0000000001250000-0x0000000001280000-memory.dmp
    Filesize

    192KB

    Download
  • memory/1732-2-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1732-4-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1732-5-0x0000000074A8E000-0x0000000074A8F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1732-6-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1732-7-0x0000000074A80000-0x000000007516E000-memory.dmp
    Filesize

    6.9MB

    Download