Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
01/07/2024, 01:57
General
- Target ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe
- Size 3.1MB
- Sample240701-cc95sssfna
- SHA256 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
192.168.1.111:4782
-
1f5e43b0-2e6e-4529-bedf-628650591bdf
-
encryption_key
0FF1E4E83CF341CB74C4BB8B5D7980A41A9AF65B
-
install_name
DescryptMain.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
- Detects executables containing common artifacts observed in infostealers 2 IoCs
- Executes dropped EXE 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe"C:\Users\Admin\AppData\Local\Temp\ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe"C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\DescryptMain.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DescryptMain.exe
memory/1092-10-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp
memory/1092-11-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp
memory/1092-12-0x000000001BAB0000-0x000000001BB00000-memory.dmp
memory/1092-13-0x000000001C310000-0x000000001C3C2000-memory.dmp
memory/1092-14-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp
memory/5024-1-0x00000000000B0000-0x00000000003D4000-memory.dmp
memory/5024-0-0x00007FFBF0D83000-0x00007FFBF0D85000-memory.dmp
memory/5024-2-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp
memory/5024-9-0x00007FFBF0D80000-0x00007FFBF1841000-memory.dmp