Overview

overview

10

Static

static

7b690a7a78...1b.exe

windows7_x64

10

7b690a7a78...1b.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    09/09/2021, 07:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7b690a7a78aebde26cbed65ac2cb281b.exe
  • Size 4.0MB
  • Sample210909-h8ftqaahfp
  • SHA256 1d49c795e503a5c5c57885ae435b84f2d00a342ea122110a075b4df7b3c4ddd2
  • MD5 SHA1 SHA512
Score
10/10
bitratquasarqua3persistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.3.0.0

Botnet

  • qua3

C2

  • yz.videomarket.eu:1972

Mutex

  • QSR_MUTEX_dQvCIzmEBFgxmMuIEE

Attributes
  • encryption_key

    Txsm23EgD4NQfzpXFJzP

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • BitRAT Payload 3 IoCs
  • Quasar Payload 3 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b690a7a78aebde26cbed65ac2cb281b.exe
    "C:\Users\Admin\AppData\Local\Temp\7b690a7a78aebde26cbed65ac2cb281b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Users\Admin\AppData\Local\Temp\7b690a7a78aebde26cbed65ac2cb281b.exe
      "C:\Users\Admin\AppData\Local\Temp\7b690a7a78aebde26cbed65ac2cb281b.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\DL3eDyOmUF8to33P.exe
        "C:\Users\Admin\AppData\Local\Temp\DL3eDyOmUF8to33P.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1052

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1052-78-0x0000000000400000-0x000000000045E000-memory.dmp
        Download

        memory/1052-81-0x0000000000400000-0x000000000045E000-memory.dmp
        Download

        memory/1052-83-0x00000000003C0000-0x00000000003C1000-memory.dmp
        Download

        memory/1260-66-0x0000000000400000-0x00000000007CE000-memory.dmp
        Download

        memory/1260-63-0x0000000000400000-0x00000000007CE000-memory.dmp
        Download

        memory/1840-62-0x00000000757C1000-0x00000000757C3000-memory.dmp
        Download