Analysis
- max time kernel
125s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
05/08/2024, 10:22
General
- Target 4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142.exe
- Size 3.1MB
- Sample240805-megw5stbpl
- SHA256 4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142
Malware Config
Extracted
-
quasar
-
1.4.1
-
GensisLoader
-
147.185.221.18:42996
-
147.185.221.18:1770
-
c2e1b18a-ce93-436d-ad8b-21bf89015e19
-
encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142.exe"C:\Users\Admin\AppData\Local\Temp\4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4328,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4284-0-0x00007FFDBE743000-0x00007FFDBE745000-memory.dmp
memory/4284-1-0x0000000000FB0000-0x00000000012D4000-memory.dmp
memory/4284-2-0x00007FFDBE740000-0x00007FFDBF201000-memory.dmp
memory/4284-3-0x000000001C9D0000-0x000000001CA20000-memory.dmp
memory/4284-4-0x000000001CAE0000-0x000000001CB92000-memory.dmp
memory/4284-5-0x00007FFDBE743000-0x00007FFDBE745000-memory.dmp
memory/4284-6-0x00007FFDBE740000-0x00007FFDBF201000-memory.dmp
memory/4284-7-0x000000001C9A0000-0x000000001C9B2000-memory.dmp
memory/4284-8-0x000000001CA60000-0x000000001CA9C000-memory.dmp