Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
27-06-2024 10:09
General
-
Target
Client-Built.exe
-
Size
3.1MB
-
MD5
832c32cbec14f7c575f8dde7713204b0
-
SHA1
c7892e4f47987566ed7fe47bb2e35362f96d24e9
-
SHA256
93b6b132ca4e190440d6fb64cc64f90fbd28d309fc389481ccb9ef83a49c0626
-
SHA512
f7980ee0f3dc1184ee65363178a66b3341c1a18593b33ead8ed76a08e3fe5bfb5f1afa91fe13b1e439c8010e0f197e505a20d4890aec16a95d3da0a117e21dc6
-
SSDEEP
49152:aI6WGoyH0I6ZUI9Iz6c/FJAAPcLPoGQNTHHB72eh2NTkS4:aI9Gdl6ZUI9UJ/8QcT
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
WormBurry
C2
147.185.221.20:15467
147.185.221.20:38852
Mutex
3f51338a-d72d-4e94-99b7-62b8774bafb8
Attributes
-
encryption_key
35D8C5468D502FD31B9068FF929210AF2F2ADC40
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Github.git
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-Built.exe"C:\Users\Admin\AppData\Local\Temp\Client-Built.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB