Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
09-02-2025 01:45
General
-
Target
9cb54445da7f827f34e69da4096146efd0196ef6363a5d075fd7c4b525ddbedc.exe
-
Size
3.1MB
-
MD5
ecbaabfbd994323f1163a76d7d5c65fd
-
SHA1
9e3883a48d219eb16f01b498a39c719214bac823
-
SHA256
9cb54445da7f827f34e69da4096146efd0196ef6363a5d075fd7c4b525ddbedc
-
SHA512
47b25f096807aa9dd9017d94559f448738d506418469ca11e45535089ee0212c5edf1e12e09673b9023bef711ec2897b45b4ac18e9198f5667c19f9753fffc8b
-
SSDEEP
49152:Pv9t62XlaSFNWPjljiFa2RoUYI6CZ1JnToGd4UTHHB72eh2NT:Pv/62XlaSFNWPjljiFXRoUYI6CZ
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office23
C2
127.0.0.1:4782
Mutex
186303e3-32b8-4c3d-afa0-f4960783e617
Attributes
-
encryption_key
2ECA181EF427859ECFAEA320EE1A367322BECDD5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cb54445da7f827f34e69da4096146efd0196ef6363a5d075fd7c4b525ddbedc.exe"C:\Users\Admin\AppData\Local\Temp\9cb54445da7f827f34e69da4096146efd0196ef6363a5d075fd7c4b525ddbedc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB