Resubmissions
06-11-2024 18:30
241106-w5he2avgka 10Analysis
-
max time kernel
100s -
max time network
141s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
06-11-2024 18:30
General
-
Target
ShcLoader.exe
-
Size
3.2MB
-
MD5
5035c5a044bc9d4a912d54b9d3342082
-
SHA1
25714bbf1aaea6c0d1ff128ef3d2ad5095da63a3
-
SHA256
583dec28f988dba9a35801b8dc3c0ce3741909aaf6e3ea31e5d823659e43209f
-
SHA512
df1cc57366a31dc1dac97f2f3194ebfca5c9329c4ecc27fe4a33efdfeb244d479ff2a2ff07e4e9dfdfe00a0b8b4eed3a45155bd1b62276007d9e61d933e3f78f
-
SSDEEP
98304:PDk4gOxkBVHpKEYWJMTER11yJKwFWMbeIc:PDng1V2WOg/MKws+e/
Malware Config
Extracted
quasar
1.4.1
Client
x0p-52599.portmap.host:52599
1e8d1992-25ef-4495-bdc8-388b816e4b2b
-
encryption_key
6CCE3B8C0D5A5CF28100953354AB7774A28FB355
-
install_name
Client.exe
-
log_directory
$xor-logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ShcLoader.exe"C:\Users\Admin\AppData\Local\Temp\ShcLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
10.8MB