Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:11
General
-
Target
55be056b6277768f3344436f323aca62fe5baaf572f804f9e32e9edc48c4802f.exe
-
Size
3.1MB
-
MD5
4e5ef939d2eaac0b886f33cdc6bbe457
-
SHA1
748d293f933dd5d1e5dd11f14cd9c16dbcadb966
-
SHA256
55be056b6277768f3344436f323aca62fe5baaf572f804f9e32e9edc48c4802f
-
SHA512
a03edd8b94da288370aa10660213f6eadaf91a6c026d8f1ea212901a43a5661c16c757348944802de782ba8a56ef2c1eeddf231c896e9c9af5da22a20db83a00
-
SSDEEP
49152:fvbI22SsaNYfdPBldt698dBcjHNpRJ6YbR3LoGd+2THHB72eh2NT:fvk22SsaNYfdPBldt6+dBcjHNpRJ6yO
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.56.1:4782
Mutex
02b4053f-9954-4680-b5cd-1fed101a4503
Attributes
-
encryption_key
921EF57210F7C5FE87D0198A92C0944F7B58C092
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55be056b6277768f3344436f323aca62fe5baaf572f804f9e32e9edc48c4802f.exe"C:\Users\Admin\AppData\Local\Temp\55be056b6277768f3344436f323aca62fe5baaf572f804f9e32e9edc48c4802f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB