Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2024 14:59

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    ada5a9cddc59be72633eba26835e7a3e

  • SHA1

    de422e113b92b1d9c6baf46b159e387c5ec5517a

  • SHA256

    2dbd31f6ed2f964d191b7077c2acecc931648cc2f1a2a43f57b0cbb35d1b72c7

  • SHA512

    c5fa3e3dd1946995c85fda7fe520b5eb34ef575e0b59fea2e01e51237fe3805a29f9d0eab2701aef9368d68e3d04a70e6f5a985d5d52d9cc1d3bcfe887b1763a

  • SSDEEP

    49152:bvbI22SsaNYfdPBldt698dBcjHm0xNESEck/iWLoGdZTHHB72eh2NT:bvk22SsaNYfdPBldt6+dBcjHNxjY

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

195.88.218.76:4782

Mutex

4b117633-2647-473d-81f9-9d4abde111bc

Attributes
  • encryption_key

    E86E3B923722E3F8294BD35A968E5EA213AFA362

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2380-0-0x000007FEF5D63000-0x000007FEF5D64000-memory.dmp

    Filesize

    4KB

  • memory/2380-1-0x0000000001110000-0x0000000001434000-memory.dmp

    Filesize

    3.1MB

  • memory/2380-2-0x000007FEF5D60000-0x000007FEF674C000-memory.dmp

    Filesize

    9.9MB

  • memory/2380-3-0x000007FEF5D63000-0x000007FEF5D64000-memory.dmp

    Filesize

    4KB

  • memory/2380-4-0x000007FEF5D60000-0x000007FEF674C000-memory.dmp

    Filesize

    9.9MB