Analysis
-
max time kernel
127s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 17:13
Behavioral task
behavioral1
Sample
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
Resource
win7-20231129-en
General
-
Target
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
-
Size
348KB
-
MD5
8436d16727f4b911f5480809103baa87
-
SHA1
50a1b81af0bf85af5a3ef841fe49746675313120
-
SHA256
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
SHA512
ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
-
SSDEEP
3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui
Malware Config
Extracted
quasar
1.3.0.0
Client
runderscore00-61208.portmap.host:61208
QSR_MUTEX_q1SPcFNLEQ1FIcq9Po
-
encryption_key
qQYEXzkyhZKvRSzcxALx
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1044-1-0x0000000001270000-0x00000000012CE000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exedescription pid process Token: SeDebugPrivilege 1044 2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1044-0-0x00000000740BE000-0x00000000740BF000-memory.dmpFilesize
4KB
-
memory/1044-1-0x0000000001270000-0x00000000012CE000-memory.dmpFilesize
376KB
-
memory/1044-2-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/1044-3-0x00000000740BE000-0x00000000740BF000-memory.dmpFilesize
4KB
-
memory/1044-4-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB