Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
19/04/2025, 10:47
General
-
Target
11c1119ca27a3d70ef72d69c3f1af1ae9540d4b5d2b48d9b3caa554ba6f54cd2.exe
-
Size
4.6MB
-
MD5
3ed992586de3ed67aad864fe62734937
-
SHA1
bcf4c8a3cbc671ba7fc6ac38b1581806913883dd
-
SHA256
11c1119ca27a3d70ef72d69c3f1af1ae9540d4b5d2b48d9b3caa554ba6f54cd2
-
SHA512
42668112eacf827325c88af0c6ec59c16b918f6f9772ef84e15a5ad8f0b5b6dd9643fe6d2467216c1374725b9c6cb742017ec7cebb6fb2763189d1d697f6ac37
-
SSDEEP
98304:/gYSDiz3Clzp6QcwQhgBe8MFLgg5A4gmRGo1q0ZT:oHDcSNcwQhgBimwtH
Malware Config
Extracted
quasar
1.4.1
Office05
192.168.0.101:2025
3f648fc9-2a82-4ca1-8687-e39e14478579
-
encryption_key
F3E6B52CEF8F81BA550B56134E7C52D02C97B9AA
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11c1119ca27a3d70ef72d69c3f1af1ae9540d4b5d2b48d9b3caa554ba6f54cd2.exe"C:\Users\Admin\AppData\Local\Temp\11c1119ca27a3d70ef72d69c3f1af1ae9540d4b5d2b48d9b3caa554ba6f54cd2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
12.2MB
-
Filesize
12.2MB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
6.1MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
12.2MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB