Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
02/11/2024, 17:06
General
- Target B658C5D7ED9CD9D40992885120E78450.exe
- Size 3.3MB
- Sample241102-vmdtfszhql
- SHA256 36c5e613a6f16466cfbea6b74f926cb9d357bf78e1e229d9f47f38e7b78a7291
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
83.168.110.87:4782
-
e7550a93-a385-490f-a2f8-5d9e1b5fd98b
-
encryption_key
19FB99CC4D38C38330C88E623B7FD5B15277B769
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
puttystart
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\B658C5D7ED9CD9D40992885120E78450.exe"C:\Users\Admin\AppData\Local\Temp\B658C5D7ED9CD9D40992885120E78450.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "puttystart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "puttystart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/1828-26-0x000000001C870000-0x000000001C8C0000-memory.dmp
memory/1828-27-0x000000001C980000-0x000000001CA32000-memory.dmp
memory/1828-30-0x000000001C900000-0x000000001C912000-memory.dmp
memory/1828-31-0x000000001D480000-0x000000001D4BC000-memory.dmp
memory/2836-14-0x00007FF988C13000-0x00007FF988C15000-memory.dmp
memory/2836-16-0x00000000003B0000-0x00000000006D4000-memory.dmp
memory/2836-18-0x00007FF988C10000-0x00007FF9896D1000-memory.dmp
memory/2836-25-0x00007FF988C10000-0x00007FF9896D1000-memory.dmp
memory/3596-3-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3596-1-0x0000000000C80000-0x0000000000FD0000-memory.dmp
memory/3596-17-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3596-0-0x00000000749CE000-0x00000000749CF000-memory.dmp