Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
30-05-2024 09:21
General
-
Target
e07d43bc3ffba13c54c974a3648488d48b6e3a9acd7be11404eb41a8b1452888.exe
-
Size
409KB
-
MD5
35e11d4aa9b81511576ac2e01dc91499
-
SHA1
8591d9f1849994a8fe97a7f01382d78905c5d110
-
SHA256
e07d43bc3ffba13c54c974a3648488d48b6e3a9acd7be11404eb41a8b1452888
-
SHA512
97f6e9c3fc5e4333467f8028f4fdf943595d4d681bdcba1fde24f5e9c48d40b5ac6da7488e71fc0e3508f2987ad807dfa85b9ba0eecadde9a669544f7df4b4ed
-
SSDEEP
6144:mMXOp5F5j+sW/bq2OhCrMEl0oAzbx8J8CG7I0vbIpgBoJwAO0KFiIkvPq8shA8:OpX5j+N/W2OhCrPlKOmCaElr5vPxs+8
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
rights-varying.gl.at.ply.gg:55443
rights-varying.gl.at.ply.gg:3348
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
eNywfhYtCnzi04z5iEfk
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
10
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e07d43bc3ffba13c54c974a3648488d48b6e3a9acd7be11404eb41a8b1452888.exe"C:\Users\Admin\AppData\Local\Temp\e07d43bc3ffba13c54c974a3648488d48b6e3a9acd7be11404eb41a8b1452888.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB