Analysis

  • max time kernel
    131s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 23:51

General

  • Target

    Remove.exe

  • Size

    409KB

  • MD5

    feb685a6bc5600e4e3e5b291432e2071

  • SHA1

    2073252bc7b2ceb812d3fc0ecb0f6c7d32089523

  • SHA256

    bcc8bd5e2381123b28409b8281612d2f3be649e4d4b8d998a9e397db109f631d

  • SHA512

    d87e0e384e79943de4e581b5b505f05b2e0dc3463279f03ceb6cfc54699c5f9e79bab7a0e277176be4eab7b7eadc450bf230af4163f65714a0d456d9288fc4dc

  • SSDEEP

    6144:rMyPp5S6M1Xy0a+agLFaSoVWy/ItKlPb2LH0yDCG4vZ3UiOi9vXna56:Hpg6M1iuagLFB4WxAlKLGjhui9v3a56

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

C2

147.185.221.20:47638

Mutex

$Sxr-5wL6M6vfG3ZS45okGB

Attributes
  • encryption_key

    Ss9r1xb2AT8fXYK3H0Z6

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    1

  • startup_key

    Update32

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Remove.exe
    "C:\Users\Admin\AppData\Local\Temp\Remove.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Update32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Remove.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3604
    • C:\Windows\SysWOW64\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77Remove.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Remove.exe'" /sc onlogon /rl HIGHEST
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4860-0-0x00000000746CE000-0x00000000746CF000-memory.dmp

    Filesize

    4KB

  • memory/4860-1-0x0000000000490000-0x00000000004FC000-memory.dmp

    Filesize

    432KB

  • memory/4860-2-0x00000000054B0000-0x0000000005A54000-memory.dmp

    Filesize

    5.6MB

  • memory/4860-3-0x0000000005020000-0x00000000050B2000-memory.dmp

    Filesize

    584KB

  • memory/4860-4-0x00000000746C0000-0x0000000074E70000-memory.dmp

    Filesize

    7.7MB

  • memory/4860-5-0x0000000004F00000-0x0000000004F66000-memory.dmp

    Filesize

    408KB

  • memory/4860-6-0x0000000005460000-0x0000000005472000-memory.dmp

    Filesize

    72KB

  • memory/4860-7-0x0000000006160000-0x000000000619C000-memory.dmp

    Filesize

    240KB

  • memory/4860-9-0x0000000006760000-0x000000000676A000-memory.dmp

    Filesize

    40KB

  • memory/4860-10-0x00000000746CE000-0x00000000746CF000-memory.dmp

    Filesize

    4KB

  • memory/4860-12-0x00000000746C0000-0x0000000074E70000-memory.dmp

    Filesize

    7.7MB