Analysis
- max time kernel
111s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/12/2024, 02:58
General
- Target 773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd.exe
- Size 72.2MB
- Sample241210-dgkalswpel
- SHA256 773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
Malware Config
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd.exe"C:\Users\Admin\AppData\Local\Temp\773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
memory/1484-40-0x00000000750C2000-0x00000000750C3000-memory.dmp
memory/1484-35-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-37-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-6-0x00000000750C0000-0x0000000075671000-memory.dmp
memory/1484-7-0x00000000750C0000-0x0000000075671000-memory.dmp
memory/1484-8-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-9-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-11-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-13-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-16-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-17-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-19-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-21-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-23-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-25-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-27-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-29-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-31-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-33-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-0-0x00000000750C2000-0x00000000750C3000-memory.dmp
memory/1484-2-0x00000000750C0000-0x0000000075671000-memory.dmp
memory/1484-41-0x00000000750C0000-0x0000000075671000-memory.dmp
memory/1484-3-0x00000000750C0000-0x0000000075671000-memory.dmp
memory/1484-42-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-44-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-49-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-47-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-51-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-53-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-62-0x00000000750C0000-0x0000000075671000-memory.dmp
memory/1484-45-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-57-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-56-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-61-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-59-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-64-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-66-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-68-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-70-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-72-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-74-0x00000000208B0000-0x00000000250D9000-memory.dmp
memory/1484-1-0x00000000750C0000-0x0000000075671000-memory.dmp