Analysis
-
max time kernel
329s -
max time network
330s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250425-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250425-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
10/05/2025, 06:28
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
5fdda3302fc0978be2a8719b6139b1cc
-
SHA1
2fc2f71c361a5506d0960167836e91f33e78d36f
-
SHA256
6904a5d6cd11daadde8b1fc4ccb2c7d0e357408e06139d16e78b0052be2f07cb
-
SHA512
87fc7c8dbd8ba38a59273a136287fb89ceec5eb7d6b799a44b10abeed659df0d8c84bf9210d5ad9b9c23df53ea1567b83030db02ae5b6dc345fc2846019b4bf5
-
SSDEEP
49152:zvqlL26AaNeWgPhlmVqvMQ7XSK3ULRJ65bR3LoGd0kTHHB72eh2NT:zvSL26AaNeWgPhlmVqkQ7XSK3ULRJ67
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
66.113.31.17:7547
Mutex
1218cd45-c0a3-4b27-9809-93fd038609ce
Attributes
-
encryption_key
55C5E8AA2B9D9174F4392BCE64D3CC8BB7487B6C
-
install_name
Quasar rat.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
C:\Windows\System32
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2468-1-0x0000000000270000-0x0000000000594000-memory.dmp family_quasar behavioral1/files/0x000800000002827d-3.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1956 Quasar rat.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\Quasar rat.exe Client-built.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4800 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2468 Client-built.exe Token: SeDebugPrivilege 1956 Quasar rat.exe Token: SeDebugPrivilege 4800 taskmgr.exe Token: SeSystemProfilePrivilege 4800 taskmgr.exe Token: SeCreateGlobalPrivilege 4800 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1956 Quasar rat.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1956 Quasar rat.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe 4800 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1956 2468 Client-built.exe 81 PID 2468 wrote to memory of 1956 2468 Client-built.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\System32\Quasar rat.exe"C:\Windows\System32\Quasar rat.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1956
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD55fdda3302fc0978be2a8719b6139b1cc
SHA12fc2f71c361a5506d0960167836e91f33e78d36f
SHA2566904a5d6cd11daadde8b1fc4ccb2c7d0e357408e06139d16e78b0052be2f07cb
SHA51287fc7c8dbd8ba38a59273a136287fb89ceec5eb7d6b799a44b10abeed659df0d8c84bf9210d5ad9b9c23df53ea1567b83030db02ae5b6dc345fc2846019b4bf5