Analysis
- max time kernel
135s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
23/08/2024, 13:57
General
- Target 1724421365548437fbee2df8be5f9f2782d09a29d0da43bfe498c7b225b42a47c097d42c7a572.dat-decoded.exe
- Size 916KB
- Sample240823-q89e2axgpb
- SHA256 d4e3e9ccf34249744cc8bbeba02fb11626604b8093edc8d85326b467e6aeb7b1
Malware Config
Extracted
-
quasar
-
2.8.0.1
-
Hotels
-
23.227.193.34:4449
-
5jEbhOzAJJ3VS1IFbs
-
encryption_key
xnJQsQUB6iQCPz2Qqr4i
-
install_name
cloud.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Startup
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1724421365548437fbee2df8be5f9f2782d09a29d0da43bfe498c7b225b42a47c097d42c7a572.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1724421365548437fbee2df8be5f9f2782d09a29d0da43bfe498c7b225b42a47c097d42c7a572.dat-decoded.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4396,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3416-0-0x000000007511E000-0x000000007511F000-memory.dmp
memory/3416-1-0x0000000000700000-0x00000000007EC000-memory.dmp
memory/3416-2-0x00000000057A0000-0x0000000005D44000-memory.dmp
memory/3416-3-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/3416-4-0x0000000075110000-0x00000000758C0000-memory.dmp
memory/3416-5-0x00000000051F0000-0x0000000005256000-memory.dmp
memory/3416-6-0x0000000006050000-0x0000000006062000-memory.dmp
memory/3416-7-0x0000000006590000-0x00000000065CC000-memory.dmp
memory/3416-8-0x0000000006CD0000-0x0000000006CDA000-memory.dmp
memory/3416-9-0x000000007511E000-0x000000007511F000-memory.dmp
memory/3416-10-0x0000000075110000-0x00000000758C0000-memory.dmp