Analysis

  • max time kernel
    17s
  • max time network
    21s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    15-12-2024 21:32

General

  • Target

    app.exe

  • Size

    3.1MB

  • MD5

    a2019f0a72aa3207bbc5dcc49626d057

  • SHA1

    0a6a3183c5fd89143017bc62ed38fea832661fc7

  • SHA256

    4bbcd5f19331b84d284dd96729b893bb69ef30fa2d3097fd4ee8dda6953b60c6

  • SHA512

    4f826f86a9a958db71f4b5776a108aa4feb5d6afa17f6e51db93e67ce1851094591d49acf9d65f86f49986b265d8e5e266584893cdc009d8e1d3bdcb050b600b

  • SSDEEP

    49152:rvilL26AaNeWgPhlmVqvMQ7XSKGNRJ6EbR3LoGdaWTHHB72eh2NT:rvaL26AaNeWgPhlmVqkQ7XSKGNRJ6O

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

KDOTCrypt

C2

us-east-65319.packetriot.net:22653

Mutex

1b077ba0-1574-4be1-aa2d-d6dbc0ef540a

Attributes
  • encryption_key

    92470F4731518ABFA77DC89068544FB7E7B7C459

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\app.exe
    "C:\Users\Admin\AppData\Local\Temp\app.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2920-0-0x00007FFED2723000-0x00007FFED2725000-memory.dmp

    Filesize

    8KB

  • memory/2920-1-0x0000000000090000-0x00000000003B4000-memory.dmp

    Filesize

    3.1MB

  • memory/2920-2-0x00007FFED2720000-0x00007FFED31E2000-memory.dmp

    Filesize

    10.8MB

  • memory/2920-3-0x000000001B030000-0x000000001B080000-memory.dmp

    Filesize

    320KB

  • memory/2920-4-0x000000001C4D0000-0x000000001C582000-memory.dmp

    Filesize

    712KB

  • memory/2920-5-0x000000001B010000-0x000000001B022000-memory.dmp

    Filesize

    72KB

  • memory/2920-6-0x000000001B0C0000-0x000000001B0FC000-memory.dmp

    Filesize

    240KB

  • memory/2920-7-0x00007FFED2723000-0x00007FFED2725000-memory.dmp

    Filesize

    8KB

  • memory/2920-8-0x00007FFED2720000-0x00007FFED31E2000-memory.dmp

    Filesize

    10.8MB