Analysis
-
max time kernel
125s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
08-12-2024 04:19
General
-
Target
e89bf9f9f461c14c2358cd5de1c1f1fcf6ecb18c0a978330e64263a863b19603.exe
-
Size
349KB
-
MD5
1b6cc280bdeeffba345f6cf8b11c2ee8
-
SHA1
f76fd450a43cf4ac5a86c8172f5edb89538bd489
-
SHA256
e89bf9f9f461c14c2358cd5de1c1f1fcf6ecb18c0a978330e64263a863b19603
-
SHA512
58768ae5f0f559c08f4247f97e934b1aa252e1d913845b10fcee35e9ee807fb03ba6f81a74a821b4dead719a6195f49a3201daf55f471f5ad2aeea662366f88c
-
SSDEEP
6144:uKMJx4pweP7kJS3i+fcwiGSUPhKA6DPusEbjL1+vcZlWE/tgE9h:uKoSUGVPF6DPus05ZlWECE9h
Malware Config
Extracted
quasar
1.3.0.0
Office04
192.168.255.139:4782
QSR_MUTEX_ZZPYrLvQ79yjfe7PwK
-
encryption_key
lrTFvNaa5qg78NZPgIUJ
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e89bf9f9f461c14c2358cd5de1c1f1fcf6ecb18c0a978330e64263a863b19603.exe"C:\Users\Admin\AppData\Local\Temp\e89bf9f9f461c14c2358cd5de1c1f1fcf6ecb18c0a978330e64263a863b19603.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
376KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB