Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-02-2025 14:31

General

  • Target

    0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe

  • Size

    3.7MB

  • MD5

    c7e6c951ca20c04d0d11b0a7d429f6d4

  • SHA1

    e8ec50949c6f6a4e8727a5091f3307381be82839

  • SHA256

    0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657

  • SHA512

    da37fb5599f0a7f405871aff2899c8ece589ff64df1081b2aa3bb563b7f505e4da25ab892094edf7c856fed34f77e0fcec9f5c285af0713d2c57e3d843a0fe67

  • SSDEEP

    98304:01bQRm7L4+pqEYlPqQ5QvWvrfZt7qA7XZ7eFq8u:0mRm7LjpqzkUQvWvrr7qmeRu

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ES CODE

C2

twart.myfirewall.org:9792

rency.ydns.eu:5287

wqo9.firewall-gateway.de:8841

code1.ydns.eu:5287

wqo9.firewall-gateway.de:9792

Mutex

025351e291-5d1041-4fa37-932c7-8L69aeiQec514992

Attributes
  • encryption_key

    3145298725BA5E0DD56E87FFE3F8898EA81E6EDA

  • install_name

    Excelworkbook.exe

  • log_directory

    Logs

  • reconnect_delay

    6000

  • startup_key

    pdfdocument

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe
    "C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe
      "C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"
      2⤵
        PID:2200
      • C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe
        "C:\Users\Admin\AppData\Local\Temp\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe" /rl HIGHEST /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3592
        • C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4132
          • C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"
            4⤵
            • Executes dropped EXE
            PID:3984
          • C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2020
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "pdfdocument" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe" /rl HIGHEST /f
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3908

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Roaming\SubDir\Excelworkbook.exe

      Filesize

      3.7MB

      MD5

      c7e6c951ca20c04d0d11b0a7d429f6d4

      SHA1

      e8ec50949c6f6a4e8727a5091f3307381be82839

      SHA256

      0d6a9673eb3db83be393b8e85fceb372b5fbad79ce1c56bd92ea4b6b3166f657

      SHA512

      da37fb5599f0a7f405871aff2899c8ece589ff64df1081b2aa3bb563b7f505e4da25ab892094edf7c856fed34f77e0fcec9f5c285af0713d2c57e3d843a0fe67

    • memory/540-13-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/540-22-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/540-15-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/540-11-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB

    • memory/2020-38-0x0000000007FF0000-0x0000000008056000-memory.dmp

      Filesize

      408KB

    • memory/2020-37-0x0000000007F40000-0x0000000007F7C000-memory.dmp

      Filesize

      240KB

    • memory/2020-36-0x0000000007EE0000-0x0000000007EF2000-memory.dmp

      Filesize

      72KB

    • memory/2020-33-0x00000000068F0000-0x00000000069A2000-memory.dmp

      Filesize

      712KB

    • memory/2020-32-0x0000000006680000-0x00000000066D0000-memory.dmp

      Filesize

      320KB

    • memory/2020-31-0x0000000006AE0000-0x00000000070F8000-memory.dmp

      Filesize

      6.1MB

    • memory/4004-7-0x000000007470E000-0x000000007470F000-memory.dmp

      Filesize

      4KB

    • memory/4004-6-0x0000000006620000-0x000000000663E000-memory.dmp

      Filesize

      120KB

    • memory/4004-10-0x000000000E800000-0x000000000E89C000-memory.dmp

      Filesize

      624KB

    • memory/4004-9-0x000000000B3F0000-0x000000000B758000-memory.dmp

      Filesize

      3.4MB

    • memory/4004-8-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4004-1-0x0000000000630000-0x00000000009E8000-memory.dmp

      Filesize

      3.7MB

    • memory/4004-0-0x000000007470E000-0x000000007470F000-memory.dmp

      Filesize

      4KB

    • memory/4004-2-0x0000000005900000-0x0000000005EA4000-memory.dmp

      Filesize

      5.6MB

    • memory/4004-3-0x00000000053F0000-0x0000000005482000-memory.dmp

      Filesize

      584KB

    • memory/4004-4-0x00000000053E0000-0x00000000053EA000-memory.dmp

      Filesize

      40KB

    • memory/4004-14-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4004-5-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4132-30-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4132-25-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4132-24-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4132-23-0x0000000074700000-0x0000000074EB0000-memory.dmp

      Filesize

      7.7MB