Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
30-11-2024 05:15
General
-
Target
ebded901ad7a09d103339a55c71092e92a0ce60f28309e219699bad267abe69d.exe
-
Size
3.1MB
-
MD5
0acba184a7a39e8a01dccac492b5b0a2
-
SHA1
9dd9dff8cc9b44106d1eee6e2609c4ad120d8832
-
SHA256
ebded901ad7a09d103339a55c71092e92a0ce60f28309e219699bad267abe69d
-
SHA512
c3f03e64849b2f29fd8f6d222d9fbec772fa02fe78e54eb26723e335d82e609910c5246fda2f83fcfa1dc8190f553e0f09f6d8bd0f05670ec1ee5def6bec59fe
-
SSDEEP
49152:Kvlt62XlaSFNWPjljiFa2RoUYIERdhdHoGdA0THHB72eh2NT:KvX62XlaSFNWPjljiFXRoUYIERdhx
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
10.0.2.0:4782
Mutex
33c681d1-8b12-4911-ba22-fb14fc44f47b
Attributes
-
encryption_key
EBF46976BE5CDF107B1DE0A2CC45E1DA40BFA827
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebded901ad7a09d103339a55c71092e92a0ce60f28309e219699bad267abe69d.exe"C:\Users\Admin\AppData\Local\Temp\ebded901ad7a09d103339a55c71092e92a0ce60f28309e219699bad267abe69d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB