Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/03/2025, 06:13
General
-
Target
7adc287e958d5eb62246c2714f59cec9.exe
-
Size
348KB
-
MD5
7adc287e958d5eb62246c2714f59cec9
-
SHA1
abb24b0c9e0b20ca97b5280e92a285cc9df2c04c
-
SHA256
8ae1ebf7431cb437d83619cfb4d991adb87e20f56b20b5e4d0d32e4b219e71c1
-
SHA512
f2afe3bdd87a1a041fd7763a626d46e1597e1f1965695a9a47e516b7383c17f03881f145981abdbeb62f23b50d6cdf4309d4b8b34a32d7b76653710eb2fcc770
-
SSDEEP
6144:F2NHXf500Ma2RNib5h7mubW0pFUoIj7FKJ6Qii/G:8d50xKb5pmBpvFKwQiAG
Malware Config
Extracted
quasar
1.3.0.0
Office04
5.178.111.227:1604
QSR_MUTEX_bpq5GgdeRU1mv1bJt5
-
encryption_key
6GhQeBE4Z58goiq8LNT2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7adc287e958d5eb62246c2714f59cec9.exe"C:\Users\Admin\AppData\Local\Temp\7adc287e958d5eb62246c2714f59cec9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
376KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB