Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/12/2024, 10:01
General
- Target VipToolMeta.exe
- Size 3.1MB
- Sample241213-l18fjsvlat
- SHA256 a4cbe08b12caf091cec50234d9a2d54ffbbd308b4e3c76ef5394c21a35d0e043
Malware Config
Extracted
-
quasar
-
1.4.1
-
Windows Client
-
148.163.102.170:4782
-
4c18e02c-7c39-4a5e-bbef-16fe13828101
-
encryption_key
73B0A3AC50C78E243EA93BF9E60C9BC63D63CA26
-
install_name
Sever Startup.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Startup
-
subdirectory
Windows Startup
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VipToolMeta.exe"C:\Users\Admin\AppData\Local\Temp\VipToolMeta.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows Startup\Sever Startup.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Sever Startup.exe
memory/2364-0-0x00007FFBC5133000-0x00007FFBC5135000-memory.dmp
memory/2364-1-0x0000000000640000-0x0000000000964000-memory.dmp
memory/2364-2-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp
memory/2364-9-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp
memory/4856-10-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp
memory/4856-11-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp
memory/4856-12-0x000000001B2D0000-0x000000001B320000-memory.dmp
memory/4856-13-0x000000001BC60000-0x000000001BD12000-memory.dmp
memory/4856-14-0x00007FFBC5130000-0x00007FFBC5BF1000-memory.dmp