Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14-11-2024 16:31
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
2364bd709ace33ac4144257da2a03282
-
SHA1
ba2272a8f9417f422ac77d84e41a55a2ad77f980
-
SHA256
af896d89bd5371a4236a7993a11484ddb5890bea7da569f61519dbe963216a88
-
SHA512
41cd1b224a9efb2ac3abc12a55963bbf1a7bef36d27c3ec0177cd71d72684eb725120e772500685f448ad32d940f602d5f91ba1cdab0463c154ad64029f42e23
-
SSDEEP
49152:yvKt62XlaSFNWPjljiFa2RoUYIFxOEMklk/JxxoGdzTHHB72eh2NT:yvi62XlaSFNWPjljiFXRoUYIFx8L
Malware Config
Extracted
quasar
1.4.1
Office04
0.tcp.us-cal-1.ngrok.io:19421
77c9d407-6130-4e2f-8d22-c4eda6d22b1f
-
encryption_key
210D68A7233E9455E4EEC5A5388A8DF203518D0F
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1500
-
startup_key
wwwwwww
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops file in System32 directory 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD52364bd709ace33ac4144257da2a03282
SHA1ba2272a8f9417f422ac77d84e41a55a2ad77f980
SHA256af896d89bd5371a4236a7993a11484ddb5890bea7da569f61519dbe963216a88
SHA51241cd1b224a9efb2ac3abc12a55963bbf1a7bef36d27c3ec0177cd71d72684eb725120e772500685f448ad32d940f602d5f91ba1cdab0463c154ad64029f42e23
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB