Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
21/08/2024, 05:10
General
- Target DOX !Aka team gnp.scr
- Size 1.5MB
- Sample240821-ft3c3avemk
- SHA256 8a9718d2658c908e0ced599e637ce1ab27cfc22e43829ae6bcf784a8591825eb
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
192.168.0.27:4782
-
52f67a9c-ccc2-4eec-a61c-1567fbfeab31
-
encryption_key
E57D88E5AA0EFBFC2E93ADCD1BD6BB2BCF4B3BAA
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOX !Aka team gnp.scr"C:\Users\Admin\AppData\Local\Temp\DOX !Aka team gnp.scr" /S1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/4436-14-0x00007FFA7A603000-0x00007FFA7A605000-memory.dmp
memory/4436-15-0x0000000000DB0000-0x00000000010D4000-memory.dmp
memory/4436-16-0x00007FFA7A600000-0x00007FFA7B0C1000-memory.dmp
memory/4436-17-0x000000001C7C0000-0x000000001C810000-memory.dmp
memory/4436-18-0x000000001C8D0000-0x000000001C982000-memory.dmp
memory/4436-19-0x00007FFA7A603000-0x00007FFA7A605000-memory.dmp
memory/4436-20-0x00007FFA7A600000-0x00007FFA7B0C1000-memory.dmp