Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 07:53

General

  • Target

    2eda48729dc77cb35b9e5cabda7a63c0daf839df13d4047c70b8dbfa288963ecN.exe

  • Size

    341KB

  • MD5

    b8507ead18b15a807cafd59c14315120

  • SHA1

    0035b089f47d010865b1792e1e8b3774e292f710

  • SHA256

    2eda48729dc77cb35b9e5cabda7a63c0daf839df13d4047c70b8dbfa288963ec

  • SHA512

    80257e8a53e173cd218bb48c9b7cfad6dddb99234c2babef4b0ae1e219b42e1ef47a4851210aa5ec3a52e82da4412b488142ec4d4345e65fa8e7385eb5b655ce

  • SSDEEP

    6144:oLRmi19KZRIo4sY7d+nTzTzTFPsWo2bMmIo7+vfep0:m19KIonkditIoufI0

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

CHAMUTLDA

C2

xowite7203-56864.portmap.host:56864

Mutex

QSR_MUTEX_b1MzVBeB2fgsMGAB8R

Attributes
  • encryption_key

    A4r7dFvwva7oUnxJWxHI

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    System

  • subdirectory

    System32

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2eda48729dc77cb35b9e5cabda7a63c0daf839df13d4047c70b8dbfa288963ecN.exe
    "C:\Users\Admin\AppData\Local\Temp\2eda48729dc77cb35b9e5cabda7a63c0daf839df13d4047c70b8dbfa288963ecN.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\2eda48729dc77cb35b9e5cabda7a63c0daf839df13d4047c70b8dbfa288963ecN.exe" /rl HIGHEST /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4580
    • C:\Users\Admin\AppData\Roaming\System32\Client.exe
      "C:\Users\Admin\AppData\Roaming\System32\Client.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:244
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System32\Client.exe" /rl HIGHEST /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\System32\Client.exe

    Filesize

    341KB

    MD5

    b8507ead18b15a807cafd59c14315120

    SHA1

    0035b089f47d010865b1792e1e8b3774e292f710

    SHA256

    2eda48729dc77cb35b9e5cabda7a63c0daf839df13d4047c70b8dbfa288963ec

    SHA512

    80257e8a53e173cd218bb48c9b7cfad6dddb99234c2babef4b0ae1e219b42e1ef47a4851210aa5ec3a52e82da4412b488142ec4d4345e65fa8e7385eb5b655ce

  • memory/244-17-0x0000000074E70000-0x0000000075620000-memory.dmp

    Filesize

    7.7MB

  • memory/244-16-0x0000000006070000-0x000000000607A000-memory.dmp

    Filesize

    40KB

  • memory/244-15-0x0000000074E70000-0x0000000075620000-memory.dmp

    Filesize

    7.7MB

  • memory/244-13-0x0000000074E70000-0x0000000075620000-memory.dmp

    Filesize

    7.7MB

  • memory/1436-3-0x00000000053B0000-0x0000000005442000-memory.dmp

    Filesize

    584KB

  • memory/1436-6-0x00000000061B0000-0x00000000061C2000-memory.dmp

    Filesize

    72KB

  • memory/1436-7-0x00000000066F0000-0x000000000672C000-memory.dmp

    Filesize

    240KB

  • memory/1436-5-0x0000000005490000-0x00000000054F6000-memory.dmp

    Filesize

    408KB

  • memory/1436-4-0x0000000074E70000-0x0000000075620000-memory.dmp

    Filesize

    7.7MB

  • memory/1436-14-0x0000000074E70000-0x0000000075620000-memory.dmp

    Filesize

    7.7MB

  • memory/1436-0-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

    Filesize

    4KB

  • memory/1436-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

    Filesize

    5.6MB

  • memory/1436-1-0x0000000000940000-0x000000000099C000-memory.dmp

    Filesize

    368KB