Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26-05-2024 11:11
General
-
Target
10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104.exe
-
Size
3.1MB
-
MD5
700acd73a0f2f3e9372fe0e60f95576f
-
SHA1
efc3b03207b3e5a999d772fd7c11fb5b69977ebc
-
SHA256
10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104
-
SHA512
a390e1b463d658beb17d9bc21e9e77f00e1dbe6dd0fc134ba682343d3a90c5a6535999aebafd1e2bad5bc319fa92072bb5efabff49878bd06d1cfee030a9db75
-
SSDEEP
49152:3vGlL26AaNeWgPhlmVqvMQ7XSKpJxNESE7k/iTLoGdoPTHHB72eh2NT:3vGL26AaNeWgPhlmVqkQ7XSKHx+f4
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
bin-inspections.gl.at.ply.gg:64055
Mutex
536deaa9-57d2-448a-ae01-b604426d7fa6
Attributes
-
encryption_key
DBB529B3F56F6D23695F8D7AC9BA28484A0D6D0F
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104.exe"C:\Users\Admin\AppData\Local\Temp\10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB