Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-10-2024 19:10
General
-
Target
62NOU_Client-built.exe
-
Size
3.1MB
-
MD5
6c0a0f358f0a60055f0426822240fdc6
-
SHA1
8e9bf932812121416df746c4290e6eaf52a6ba83
-
SHA256
1db4785c2e4ffdbc8a18149d6da1ae157cb234e1837e5aae5de5db799825b0fe
-
SHA512
c81992d751e8122e0fe34b5f9dd79220091bcfc2c777421693edf344bfc427f07239e39bf266ab8974f2c2b28463a5e830e42b4401615615202e551903a6dbab
-
SSDEEP
49152:avbI22SsaNYfdPBldt698dBcjHhXYRxkDvJcQoGdPTHHB72eh2NT:avk22SsaNYfdPBldt6+dBcjHEk7
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
127.0.0.1:4782
127.0.0.1:80
Mutex
41dbc4e3-4c49-4e37-971d-bce5c6356d47
Attributes
-
encryption_key
5446A6EE72AE0400FB80FEE45AC7AEB6FA7DD14B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62NOU_Client-built.exe"C:\Users\Admin\AppData\Local\Temp\62NOU_Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
8KB
-
Filesize
10.8MB