Analysis

  • max time kernel
    94s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-01-2025 07:11

General

  • Target

    4c7a86733a4ac849eec1b49179f64b81ed852c47be714d91c3b00d64b79e1399N.exe

  • Size

    514B

  • MD5

    6a0393cce6ff34424ddad27b162b67f0

  • SHA1

    c67c3d31dd2891d9f0cd070cdf957554ecfd3550

  • SHA256

    4c7a86733a4ac849eec1b49179f64b81ed852c47be714d91c3b00d64b79e1399

  • SHA512

    6d3c3819261150d27de6f037b7ffbdb0287bd1bb1ffe8cdd84e2a89503e24bc664489d997dbfe5f883a93229b3305fb14b104a8bdcdbee9f39b06684f5717cbc

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

2026

C2

win32updatess.DUCKDNS.ORG:2

Mutex

b70adc1c-122d-4b90-9f59-304d0ab81cd5

Attributes
  • encryption_key

    CE02DB1ED3D345B2461CC2276CDEEDF58EF19723

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c7a86733a4ac849eec1b49179f64b81ed852c47be714d91c3b00d64b79e1399N.exe
    "C:\Users\Admin\AppData\Local\Temp\4c7a86733a4ac849eec1b49179f64b81ed852c47be714d91c3b00d64b79e1399N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Users\Admin\AppData\Local\Temp\c.exe
      "C:\Users\Admin\AppData\Local\Temp\c.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:4636
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:1204
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2904

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\c.exe

        Filesize

        3.3MB

        MD5

        85f734c7ff103995e9ffa75bf661ef4f

        SHA1

        577f8c3cf3c1c78c7f227508d764c6f9c41d4e5c

        SHA256

        12ec384e29c8c0f15c05583dd84dbe719c454d70cafca9ee3de8dd2fa51f05ee

        SHA512

        c273bfbd0ffda0625ba8c2b91af6a105cc734ccd544f20f7d43f75328c34585f643bb2c9158d4107ac3404ad3278107200c984a3694359230b55999a9de026ac

      • memory/2300-22-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2300-13-0x0000000002BA0000-0x0000000002BA6000-memory.dmp

        Filesize

        24KB

      • memory/2300-24-0x0000000005180000-0x000000000519E000-memory.dmp

        Filesize

        120KB

      • memory/2300-23-0x0000000006990000-0x0000000006CB6000-memory.dmp

        Filesize

        3.1MB

      • memory/2300-15-0x000000000CBC0000-0x000000000CEF4000-memory.dmp

        Filesize

        3.2MB

      • memory/2300-16-0x000000000D4A0000-0x000000000DA44000-memory.dmp

        Filesize

        5.6MB

      • memory/2300-17-0x0000000006380000-0x0000000006412000-memory.dmp

        Filesize

        584KB

      • memory/2300-18-0x00000000029B0000-0x00000000029B6000-memory.dmp

        Filesize

        24KB

      • memory/2300-19-0x0000000006770000-0x000000000677A000-memory.dmp

        Filesize

        40KB

      • memory/2300-20-0x0000000006810000-0x0000000006886000-memory.dmp

        Filesize

        472KB

      • memory/2300-21-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

        Filesize

        4KB

      • memory/2300-11-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

        Filesize

        4KB

      • memory/2300-27-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2300-12-0x0000000000360000-0x00000000006BA000-memory.dmp

        Filesize

        3.4MB

      • memory/2300-14-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2904-39-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2904-28-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2904-29-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2904-30-0x00000000067C0000-0x0000000006DD8000-memory.dmp

        Filesize

        6.1MB

      • memory/2904-31-0x0000000006220000-0x0000000006270000-memory.dmp

        Filesize

        320KB

      • memory/2904-32-0x0000000006490000-0x0000000006542000-memory.dmp

        Filesize

        712KB

      • memory/2904-35-0x0000000007960000-0x0000000007972000-memory.dmp

        Filesize

        72KB

      • memory/2904-36-0x00000000079C0000-0x00000000079FC000-memory.dmp

        Filesize

        240KB

      • memory/2904-37-0x0000000007A70000-0x0000000007AD6000-memory.dmp

        Filesize

        408KB

      • memory/2904-38-0x0000000074B40000-0x00000000752F0000-memory.dmp

        Filesize

        7.7MB

      • memory/2904-25-0x0000000000400000-0x0000000000724000-memory.dmp

        Filesize

        3.1MB