Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/12/2024, 13:57
General
- Target rat2.0.exe
- Size 3.1MB
- Sample241213-q9ft4sslem
- SHA256 ca6205581da131085d4fd448d7a6cb47627ebf0eeeb7e42d7c1047d18631c9b0
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
192.168.56.1:4782
-
192.168.42.36:4782
-
a2375055-d323-4f14-953b-13f74ff9f85a
-
encryption_key
36B9F39EDDE38B2DC6E38AA9208FBAD7687FDB50
-
install_name
Pygame.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat2.0.exe"C:\Users\Admin\AppData\Local\Temp\rat2.0.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\SubDir\Pygame.exe"C:\Program Files\SubDir\Pygame.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Pygame.exe
memory/428-9-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp
memory/428-11-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp
memory/428-12-0x000000001BBD0000-0x000000001BC20000-memory.dmp
memory/428-13-0x000000001BCE0000-0x000000001BD92000-memory.dmp
memory/428-14-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp
memory/4572-0-0x00007FFE174C3000-0x00007FFE174C5000-memory.dmp
memory/4572-1-0x0000000000C70000-0x0000000000F94000-memory.dmp
memory/4572-2-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp
memory/4572-10-0x00007FFE174C0000-0x00007FFE17F81000-memory.dmp