Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 01:34
General
-
Target
xxwewe33/EIUWI383IE.exe
-
Size
639KB
-
MD5
c00caf990793d69120a0abc4bf0e3210
-
SHA1
f5556f65bdbc1dd62286d353312646215a14f079
-
SHA256
04c777837d0d418e78fddbbb35587b205e1a424adda5a552363e2164cf2df686
-
SHA512
a93365fc0ecf746c074d08fd784c6af7556d06e2646b2b167b67d03554e8dcc37f67804562fcdb4a09a2e117db3f893e4cc192280145531354cea7605e834e14
-
SSDEEP
6144:T2aV3QDwJdsnu08zrJU/3AsBzDxm4GBohCv3ER0u+GIIIIIIIhIIIIIIIIIIIIIK:T2aJQDw/snpCu3j+4GBocsm5Q05
Score
10/10
Malware Config
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xxwewe33\EIUWI383IE.exe"C:\Users\Admin\AppData\Local\Temp\xxwewe33\EIUWI383IE.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
10.8MB