Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2024 14:59

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    ada5a9cddc59be72633eba26835e7a3e

  • SHA1

    de422e113b92b1d9c6baf46b159e387c5ec5517a

  • SHA256

    2dbd31f6ed2f964d191b7077c2acecc931648cc2f1a2a43f57b0cbb35d1b72c7

  • SHA512

    c5fa3e3dd1946995c85fda7fe520b5eb34ef575e0b59fea2e01e51237fe3805a29f9d0eab2701aef9368d68e3d04a70e6f5a985d5d52d9cc1d3bcfe887b1763a

  • SSDEEP

    49152:bvbI22SsaNYfdPBldt698dBcjHm0xNESEck/iWLoGdZTHHB72eh2NT:bvk22SsaNYfdPBldt6+dBcjHNxjY

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

195.88.218.76:4782

Mutex

4b117633-2647-473d-81f9-9d4abde111bc

Attributes
  • encryption_key

    E86E3B923722E3F8294BD35A968E5EA213AFA362

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1hjgNavw45ZJ.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:4392
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2708

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1hjgNavw45ZJ.bat

      Filesize

      213B

      MD5

      0eefeb9434c36f223b930bd6b88badbe

      SHA1

      7967bbc76298218580d7bff5bdebe67124006767

      SHA256

      2ddf665991f7f742384c54d79e525e7006e388328cbacb2dcbffb0d8f09ee5c0

      SHA512

      1cd6249d2785d56d4f62b3b8d8a7021bf2362e00df6019e95514660800c8979f5307b8b5a0a8444961b995325828aaea86a6ef435de5e0a77cc3746e215010de

    • memory/3132-0-0x00007FFB904E3000-0x00007FFB904E5000-memory.dmp

      Filesize

      8KB

    • memory/3132-1-0x0000000000FF0000-0x0000000001314000-memory.dmp

      Filesize

      3.1MB

    • memory/3132-2-0x00007FFB904E0000-0x00007FFB90FA1000-memory.dmp

      Filesize

      10.8MB

    • memory/3132-3-0x000000001CA20000-0x000000001CA70000-memory.dmp

      Filesize

      320KB

    • memory/3132-4-0x000000001CB30000-0x000000001CBE2000-memory.dmp

      Filesize

      712KB

    • memory/3132-5-0x000000001C9F0000-0x000000001CA02000-memory.dmp

      Filesize

      72KB

    • memory/3132-6-0x000000001CAB0000-0x000000001CAEC000-memory.dmp

      Filesize

      240KB

    • memory/3132-7-0x00007FFB904E3000-0x00007FFB904E5000-memory.dmp

      Filesize

      8KB

    • memory/3132-8-0x00007FFB904E0000-0x00007FFB90FA1000-memory.dmp

      Filesize

      10.8MB

    • memory/3132-14-0x00007FFB904E0000-0x00007FFB90FA1000-memory.dmp

      Filesize

      10.8MB