Analysis
- max time kernel
141s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
20/08/2024, 11:59
General
- Target Office16.exe
- Size 3.1MB
- Sample240820-n5q36svamn
- SHA256 b67eab6b528f625eaeb6f24c4b255f5fc608f2fd030887837b919f63062e173e
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
loletScript-55049.portmap.host:55049
-
83ccefa2-233e-4371-bd98-f84307d3d975
-
encryption_key
237F842816ACAEB97B9536F65F6A1A362E20E605
-
install_name
Sirhurt.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Office16.exe"C:\Users\Admin\AppData\Local\Temp\Office16.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Sirhurt.exe"C:\Users\Admin\AppData\Roaming\SubDir\Sirhurt.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Sirhurt.exe
memory/2120-0-0x00007FFAC6D53000-0x00007FFAC6D55000-memory.dmp
memory/2120-1-0x0000000000740000-0x0000000000A6A000-memory.dmp
memory/2120-2-0x00007FFAC6D50000-0x00007FFAC7811000-memory.dmp
memory/2120-9-0x00007FFAC6D50000-0x00007FFAC7811000-memory.dmp
memory/4236-8-0x00007FFAC6D50000-0x00007FFAC7811000-memory.dmp
memory/4236-10-0x00007FFAC6D50000-0x00007FFAC7811000-memory.dmp
memory/4236-11-0x00000000029B0000-0x0000000002A00000-memory.dmp
memory/4236-12-0x000000001B920000-0x000000001B9D2000-memory.dmp
memory/4236-13-0x00007FFAC6D50000-0x00007FFAC7811000-memory.dmp