Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-11-2024 13:21
General
-
Target
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe
-
Size
3.1MB
-
MD5
112052df0155dc61ccd59a085552acc2
-
SHA1
0da0103f733680888948585e1e1cbb50711c0a3f
-
SHA256
ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b
-
SHA512
78f7bfc985fbae2f030ea1268d087b7b68e532bd3f44181fe0c28dd906ebbb858687209b60fbf7d1f8cdc84ee09374a9d55cfb0834ae9fd51e98b5effcb60645
-
SSDEEP
49152:zvkI22SsaNYfdPBldt698dBcjHetxNESEUk/iSboGdzTHHB72eh2NT:zvJ22SsaNYfdPBldt6+dBcjH4xjU
Malware Config
Extracted
quasar
1.4.1
Office04
154.83.15.5:4782
f471b896-c945-43dc-9217-eb1657caa328
-
encryption_key
2B2223EBAC01E73CC719C15E7C1A885C0BBF24EC
-
install_name
ww.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe"C:\Users\Admin\AppData\Local\Temp\ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\ww.exe"C:\Users\Admin\AppData\Roaming\SubDir\ww.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5112052df0155dc61ccd59a085552acc2
SHA10da0103f733680888948585e1e1cbb50711c0a3f
SHA256ccb2c986ff616e7cef66ed4d54c5845c9af511bd3b796e1d7ca5d5a41b60367b
SHA51278f7bfc985fbae2f030ea1268d087b7b68e532bd3f44181fe0c28dd906ebbb858687209b60fbf7d1f8cdc84ee09374a9d55cfb0834ae9fd51e98b5effcb60645
-
Filesize
10.8MB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
10.8MB
-
Filesize
1.0MB