Overview

overview

10

Static

static

1

service.bat

windows10-ltsc_2021-x64

3

service.bat

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    service.bat
  • Size 32.7MB
  • Sample260415-ac4a5sb18q
  • SHA256 1b73e3266247d73fb3ae5495713e9728d84723a3f03592c85f3f481617931e4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
quasarseroxenv15.4.5 | seroxendefense_evasiondiscoverypersistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.0

Botnet

  • v15.4.5 | SeroXen

C2

  • 127.0.0.1:1414

Mutex

  • eca48173-25b7-4921-b841-677068db408f

Attributes
  • encryption_key

    67A0E007E8040781555357CF64D2D7A0B9C74F25

  • install_name

    .exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    $sxr-seroxen

Targets

    • Target
      service.bat
    • Size 32.7MB
    • SHA256 1b73e3266247d73fb3ae5495713e9728d84723a3f03592c85f3f481617931e4a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryv15.4.5 | seroxendefense_evasionquasarseroxenpersistencespywaretrojan

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Family: Seroxen, Ser0xen

      Seroxen or SeroXen aka Ser0Xen is a trojan fist disovered in late 2022.

      trojanseroxen

    • Quasar payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft NirCmd

      NirCmd is a lightweight Windows command-line tool for automating system tasks

    • Executes dropped EXE

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks