Analysis
-
max time kernel
119s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 17:13
Behavioral task
behavioral1
Sample
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
Resource
win7-20231129-en
General
-
Target
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
-
Size
348KB
-
MD5
8436d16727f4b911f5480809103baa87
-
SHA1
50a1b81af0bf85af5a3ef841fe49746675313120
-
SHA256
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
SHA512
ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
-
SSDEEP
3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui
Malware Config
Extracted
quasar
1.3.0.0
Client
runderscore00-61208.portmap.host:61208
QSR_MUTEX_q1SPcFNLEQ1FIcq9Po
-
encryption_key
qQYEXzkyhZKvRSzcxALx
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1664-1-0x00000000005F0000-0x000000000064E000-memory.dmp family_quasar -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exedescription pid process Token: SeDebugPrivilege 1664 2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmpFilesize
4KB
-
memory/1664-1-0x00000000005F0000-0x000000000064E000-memory.dmpFilesize
376KB
-
memory/1664-2-0x0000000005570000-0x0000000005B14000-memory.dmpFilesize
5.6MB
-
memory/1664-3-0x00000000050A0000-0x0000000005132000-memory.dmpFilesize
584KB
-
memory/1664-4-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB
-
memory/1664-5-0x0000000005140000-0x00000000051A6000-memory.dmpFilesize
408KB
-
memory/1664-6-0x0000000005D60000-0x0000000005D72000-memory.dmpFilesize
72KB
-
memory/1664-7-0x00000000062A0000-0x00000000062DC000-memory.dmpFilesize
240KB
-
memory/1664-8-0x0000000074C4E000-0x0000000074C4F000-memory.dmpFilesize
4KB
-
memory/1664-9-0x0000000006460000-0x000000000646A000-memory.dmpFilesize
40KB
-
memory/1664-10-0x0000000074C40000-0x00000000753F0000-memory.dmpFilesize
7.7MB