Analysis
-
max time kernel
298s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-10-2024 07:39
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
e66da355fd3824d7cb83a1460ccdf7ff
-
SHA1
e5c00c3fcb2703b7e71e6a39bb6b3fff0d60c938
-
SHA256
b99db344c7736d6670081a4aa48a62b2ea3566b2e665413c5c0fbbcf43f8c9ca
-
SHA512
411a983f86bd1eb28326bbe03fdf76146c7acf813051876f00474bc96725d5fae4bc59b527c3ce80a39f9146ad6c4dfee18adc5056ab8ac80e57e4e27fbae856
-
SSDEEP
49152:KvTI22SsaNYfdPBldt698dBcjH5i5PkoGd9THHB72eh2NT:Kvs22SsaNYfdPBldt6+dBcjH5i5c
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.1.103:4782
f71d790f-faf7-4074-a415-aa94634f9a9b
-
encryption_key
9D377AC0024B5DFCC6111678695ABD8EBAF41CD8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5e66da355fd3824d7cb83a1460ccdf7ff
SHA1e5c00c3fcb2703b7e71e6a39bb6b3fff0d60c938
SHA256b99db344c7736d6670081a4aa48a62b2ea3566b2e665413c5c0fbbcf43f8c9ca
SHA512411a983f86bd1eb28326bbe03fdf76146c7acf813051876f00474bc96725d5fae4bc59b527c3ce80a39f9146ad6c4dfee18adc5056ab8ac80e57e4e27fbae856
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
10.8MB