Analysis
- max time kernel
103s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/10/2024, 16:06
General
- Target 389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87aN.exe
- Size 816KB
- Sample241027-tkc9gaxjan
- SHA256 389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87a
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Office04
-
ronymahmoud.casacam.net:4782
-
sk.servemp3.com:4782
-
QSR_MUTEX_ewyaHKCedalfiUvTpL
-
encryption_key
6LTEKnkEacVI1BGQJRaJ
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87aN.exe"C:\Users\Admin\AppData\Local\Temp\389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87aN.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87aN.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jGqahBGIEd.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jGqahBGIEd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAFD3.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_0njg4wug.knw.ps1
tmpAFD3.tmp
memory/1720-41-0x0000000000400000-0x000000000045E000-memory.dmp
memory/1720-49-0x0000000005400000-0x0000000005412000-memory.dmp
memory/1720-75-0x00000000060F0000-0x000000000612C000-memory.dmp
memory/1764-5-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/1764-8-0x0000000074F3E000-0x0000000074F3F000-memory.dmp
memory/1764-9-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/1764-10-0x0000000006810000-0x00000000068B0000-memory.dmp
memory/1764-11-0x00000000094B0000-0x000000000954C000-memory.dmp
memory/1764-7-0x0000000006AD0000-0x0000000006E24000-memory.dmp
memory/1764-6-0x00000000054C0000-0x00000000054D0000-memory.dmp
memory/1764-0-0x0000000074F3E000-0x0000000074F3F000-memory.dmp
memory/1764-4-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/1764-3-0x0000000005210000-0x00000000052A2000-memory.dmp
memory/1764-46-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/1764-2-0x00000000058A0000-0x0000000005E44000-memory.dmp
memory/1764-1-0x0000000000770000-0x0000000000842000-memory.dmp
memory/4520-76-0x00000000077D0000-0x00000000077DA000-memory.dmp
memory/4520-61-0x00000000073C0000-0x00000000073DE000-memory.dmp
memory/4520-89-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/4520-82-0x0000000007AA0000-0x0000000007ABA000-memory.dmp
memory/4520-21-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/4520-81-0x00000000079A0000-0x00000000079B4000-memory.dmp
memory/4520-80-0x0000000007990000-0x000000000799E000-memory.dmp
memory/4520-20-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/4520-50-0x00000000073E0000-0x0000000007412000-memory.dmp
memory/4520-51-0x00000000757E0000-0x000000007582C000-memory.dmp
memory/4520-79-0x0000000007960000-0x0000000007971000-memory.dmp
memory/4864-74-0x00000000078E0000-0x00000000078FA000-memory.dmp
memory/4864-48-0x0000000006620000-0x000000000666C000-memory.dmp
memory/4864-29-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/4864-73-0x0000000007F20000-0x000000000859A000-memory.dmp
memory/4864-19-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/4864-18-0x0000000005690000-0x0000000005CB8000-memory.dmp
memory/4864-77-0x0000000007B60000-0x0000000007BF6000-memory.dmp
memory/4864-62-0x00000000757E0000-0x000000007582C000-memory.dmp
memory/4864-78-0x0000000007AE0000-0x0000000007AF1000-memory.dmp
memory/4864-72-0x00000000075A0000-0x0000000007643000-memory.dmp
memory/4864-47-0x0000000005330000-0x000000000534E000-memory.dmp
memory/4864-23-0x0000000005E30000-0x0000000005E52000-memory.dmp
memory/4864-83-0x0000000007C00000-0x0000000007C08000-memory.dmp
memory/4864-17-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/4864-16-0x0000000005020000-0x0000000005056000-memory.dmp
memory/4864-90-0x0000000074F30000-0x00000000756E0000-memory.dmp
memory/4864-30-0x0000000005F70000-0x0000000005FD6000-memory.dmp