Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01-06-2024 16:30
General
-
Target
c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e.exe
-
Size
3.1MB
-
MD5
f73c79f1b3f1baaf66b5217591617996
-
SHA1
7adf50ec4e343c7c890f360041206146bd166807
-
SHA256
c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e
-
SHA512
5ca6289d009234ce50b4fdbecb2c51898c812b7175af6d7753ffcdfac94c849530b13346b903d8b8f7fad240835c957fda0421fa73e97a1943410da3eb00a426
-
SSDEEP
49152:PvFG42pda6D+/PjlLOlg6yQipV5PRJ6ebR3LoGdhTHHB72eh2NT:Pv842pda6D+/PjlLOlZyQipV5PRJ6Y
Malware Config
Extracted
quasar
1.4.1
Office04
10.128.49.236:4783
10.128.49.71:4783
127.0.0.1:4783
eeb9accf-baef-479b-ac89-0eaf9d0c2e80
-
encryption_key
7C1BD457B9B162A1B4E9153B6861CCB30916DB14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e.exe"C:\Users\Admin\AppData\Local\Temp\c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
8KB
-
Filesize
10.8MB