Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
11/07/2024, 04:51
General
-
Target
stub.exe
-
Size
53.7MB
-
MD5
9cd2d4b7e25115e134918d2047775d2b
-
SHA1
9e95df3a5c42feadeb4892ac411053035b0f36f6
-
SHA256
eee70db6c16fcfe19c9f9811344699dcb91921d4584c28e78963aba4214050f4
-
SHA512
5007f3932c10001395db178ed6fafbf89cea97ec8238327533e63f286262dd25fe2876a06cc2205c6033d5019a26fd60b70ada1eddc2bbcea954c010bc65d890
-
SSDEEP
1572864:d5q2Edpp1DAdFV+rkBg7DcO3ZOzsUsVHiphQMl+9MlxE0mhxAd:7gppGgP1IzsfVyQA+E3
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
147.185.221.20:9835
147.185.221.20:18563
Mutex
da84adab-a321-4164-9473-73ad56cb4ed3
Attributes
-
encryption_key
99DD896C463A5DEFC60E5185D43A6893ACB75CFB
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
53.8MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
680KB
-
Filesize
8KB
-
Filesize
10.8MB