Analysis

  • max time kernel
    7s
  • max time network
    63s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    17-07-2020 15:38

General

  • Target

    Timsistem_Product_Specifications - 2020.07.17.exe

  • Size

    759KB

  • MD5

    6998368a7e9f5e063f5b5a0090112545

  • SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

  • SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

  • SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

Malware Config

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Executes dropped EXE 10 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops startup file 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Timsistem_Product_Specifications - 2020.07.17.exe
    "C:\Users\Admin\AppData\Local\Temp\Timsistem_Product_Specifications - 2020.07.17.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3748
    • C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      2⤵
      • Drops startup file
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:3956
      • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3488
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" /rl HIGHEST /f
            5⤵
            • Creates scheduled task(s)
            PID:3280
          • C:\Windows\SysWOW64\SubDir\svchost.exe
            "C:\Windows\SysWOW64\SubDir\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3008
            • C:\Windows\SysWOW64\notepad.exe
              "C:\Windows\system32\notepad.exe"
              6⤵
              • Drops startup file
              • NTFS ADS
              • Suspicious use of WriteProcessMemory
              PID:496
              • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
                "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:2116
                • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"
                  8⤵
                  • Executes dropped EXE
                  PID:3808
                • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 3808 68046
                  8⤵
                  • Executes dropped EXE
                  PID:996
        • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 3488 63671
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3812
          • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2668
            • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
              "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3692
            • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe
              "C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe" 2 3692 67515
              6⤵
              • Executes dropped EXE
              PID:664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\taskmgr.exe.log

    MD5

    1efce85e583a7a2f123317a20f889d04

    SHA1

    60f71aa73ea2e2a48ed1c17e3c6d440abf39c914

    SHA256

    2b5532a94879134a876b11c188ade1a61deaba6a80fe1f3a3a77cc442f1cca0d

    SHA512

    45a5cd283e6a6ac34c3d8b1a6d73dc1cf52d8c974cf84624e8e9924eddaf354ccda929bce728b47db2b62175e47bdc3eaca6bc6b84d3565881fa87c50319d24c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs

    MD5

    64765fe4d97daab1b9268880bf56c0ac

    SHA1

    b9ea9ef748ae728440239d32d8f62b26f267c71a

    SHA256

    09e290974a7ac3c934346bcd28c1da4466468d3e72d2749fde8d304a5a7fe8c1

    SHA512

    4df122d45f3294422cc4f94af3b7ed275810e462fb98504935ee23274062dcb684c6070595cfa54633f6cb1a19efed0d422e37107f092973d4238ca5c11fd781

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Users\Admin\AppData\Roaming\SubDir\taskmgr.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Windows\SysWOW64\SubDir\svchost.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • C:\Windows\SysWOW64\SubDir\svchost.exe

    MD5

    6998368a7e9f5e063f5b5a0090112545

    SHA1

    c7659c9e1b683d7044267b6960a30ca6473ca945

    SHA256

    cf09bc45a7101670e26f9468d7425a42880ee539626b1653216c4ceb4a89b7fb

    SHA512

    d5044c8d53cfa2483b9f923fd2eca3f9c50ff97712ac36a2d33792ef7fc5ee9cbf504128d9a280130668cadb49b132f6de278fdbbc58b18ee07b5ee0e3bc210e

  • memory/496-17-0x0000000000000000-mapping.dmp

  • memory/664-23-0x0000000000000000-mapping.dmp

  • memory/996-38-0x0000000000000000-mapping.dmp

  • memory/2116-25-0x0000000000000000-mapping.dmp

  • memory/2668-18-0x0000000000000000-mapping.dmp

  • memory/3008-14-0x0000000000000000-mapping.dmp

  • memory/3236-1-0x0000000000000000-mapping.dmp

  • memory/3280-13-0x0000000000000000-mapping.dmp

  • memory/3488-4-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/3488-8-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/3488-12-0x00000000022E2000-0x00000000022E3000-memory.dmp

    Filesize

    4KB

  • memory/3488-11-0x00000000021D0000-0x0000000002232000-memory.dmp

    Filesize

    392KB

  • memory/3488-5-0x00000000004CE100-mapping.dmp

  • memory/3488-9-0x0000000000400000-0x00000000004D0000-memory.dmp

    Filesize

    832KB

  • memory/3692-30-0x0000000000B12000-0x0000000000B13000-memory.dmp

    Filesize

    4KB

  • memory/3692-21-0x00000000004CE100-mapping.dmp

  • memory/3692-28-0x0000000002220000-0x0000000002282000-memory.dmp

    Filesize

    392KB

  • memory/3808-35-0x00000000004CE100-mapping.dmp

  • memory/3808-40-0x00000000021E0000-0x0000000002242000-memory.dmp

    Filesize

    392KB

  • memory/3808-42-0x0000000002272000-0x0000000002273000-memory.dmp

    Filesize

    4KB

  • memory/3812-7-0x0000000000000000-mapping.dmp

  • memory/3956-0-0x0000000000000000-mapping.dmp