General
-
Target
Lose2himato.exe
-
Size
135.3MB
-
Sample
241217-n9zacazlcn
-
MD5
30b32bc02534355b906a37951b458808
-
SHA1
61eada367af3558e45c8583e174cdef13e68b93b
-
SHA256
6f08d8eb4044dd872b38ff8d6a2b6e86efa9f7d777cb1b09e1f575bfed9467a2
-
SHA512
8735788ded8836ac0b5be86356263cba2899367964ca8711a8d89b84cecf8c50be799274bfae5d4c6b8bc5d4dea7f04f836f10bf230041677c61977299887839
-
SSDEEP
786432:zl5HNB9mAbrDMZBfPPgs9TFMd15DeSqVO0EQWW2IxEm+KoZd7APUF85n9wwTtLwG:J5gOsPfmZ0/EmREdEPUF85nSUgTI
Behavioral task
behavioral1
Sample
Lose2himato.exe
Resource
win11-20241007-en
Malware Config
Extracted
quasar
1.4.1
Office04
himato667-58401.portmap.host:58401
0e2bc079-3316-407c-a26f-115195d9fe5b
-
encryption_key
D14CC6B8490A41A48C1E115285B6932B9A857EA0
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
-
Target
Lose2himato.exe
-
Size
135.3MB
-
MD5
30b32bc02534355b906a37951b458808
-
SHA1
61eada367af3558e45c8583e174cdef13e68b93b
-
SHA256
6f08d8eb4044dd872b38ff8d6a2b6e86efa9f7d777cb1b09e1f575bfed9467a2
-
SHA512
8735788ded8836ac0b5be86356263cba2899367964ca8711a8d89b84cecf8c50be799274bfae5d4c6b8bc5d4dea7f04f836f10bf230041677c61977299887839
-
SSDEEP
786432:zl5HNB9mAbrDMZBfPPgs9TFMd15DeSqVO0EQWW2IxEm+KoZd7APUF85n9wwTtLwG:J5gOsPfmZ0/EmREdEPUF85nSUgTI
-
Quasar family
-
Quasar payload
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables Task Manager via registry modification
-
Indicator Removal: Network Share Connection Removal
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Account Manipulation
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Network Share Connection Removal
1Modify Registry
1Discovery
Browser Information Discovery
1Permission Groups Discovery
1Local Groups
1Query Registry
2Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1