Overview

overview

10

Static

static

178e5e0d6d...de.exe

windows7_x64

10

178e5e0d6d...de.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    159s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    15-02-2022 16:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    178e5e0d6dbe5efae3613343b8569a95cb92d4c9f1e7593247f77265fe2be0de.exe

  • Size

    6.8MB

  • MD5

    4d8eb19e4c6ad857cf5f0b1eed9613a6

  • SHA1

    a907eb422049512f9efcfbefc7bf9fb5a2500d89

  • SHA256

    178e5e0d6dbe5efae3613343b8569a95cb92d4c9f1e7593247f77265fe2be0de

  • SHA512

    74a2be4e0acdb4378f20a7b9ca4ac753fa0faad57b67163d087e1ec79df808e1ffc2d5687e6404a126645939f4dd8128a095077d85ac933aaa7fdeba3e4714ce

Score
10/10
quasarvapeuserevasionspywarethemidatrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

VapeUser

C2

pangrowman.myddns.me:4782

Mutex

d7ca8b59-e988-46e5-b633-b83737aaab77

Attributes
  • encryption_key

    843E9B8CFBAC676CE893EA246D37E169B7DB0FB4

  • install_name

    MicrosoftSupport.exe

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    Windows Support

  • subdirectory

    Windows

Signatures

  • Quasar Payload 3 IoCs
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Executes dropped EXE 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\178e5e0d6dbe5efae3613343b8569a95cb92d4c9f1e7593247f77265fe2be0de.exe
    "C:\Users\Admin\AppData\Local\Temp\178e5e0d6dbe5efae3613343b8569a95cb92d4c9f1e7593247f77265fe2be0de.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\Ijgfvrk.exe
      "C:\Users\Admin\AppData\Local\Temp\Ijgfvrk.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Windows Support" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Ijgfvrk.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2100
    • C:\Users\Admin\AppData\Local\Temp\Ejwkpjr.exe
      "C:\Users\Admin\AppData\Local\Temp\Ejwkpjr.exe"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3876
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 3876 -s 720
        3⤵
        • Program crash
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3316
  • C:\Windows\system32\MusNotifyIcon.exe
    %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
    1⤵
    • Checks processor information in registry
    PID:3556
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    PID:2504
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:620
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 368 -p 3876 -ip 3876
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Ejwkpjr.exe
    MD5

    3459f3a3d65fa445d1eb52611ac55f6c

    SHA1

    135c835edfeec60e41bc1b24f1a10ad7a86c9a00

    SHA256

    9c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944

    SHA512

    1dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Ejwkpjr.exe
    MD5

    3459f3a3d65fa445d1eb52611ac55f6c

    SHA1

    135c835edfeec60e41bc1b24f1a10ad7a86c9a00

    SHA256

    9c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944

    SHA512

    1dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Ijgfvrk.exe
    MD5

    e1032a4d1c87a284617af64f9d29be37

    SHA1

    3e60cab4c29c96edcf30d93e1c55cdeaacfd5c66

    SHA256

    fc7f67995d35e7ce3281ba1e9d1949a068f2d21a9deb67e575c1241f265f63fa

    SHA512

    a1ef68c8e524ae9dda469c384aab4fac94e8c313f961a9c4006a8324d2e098625a95eb2f6309f00b2ad7dc9cf4116f8dc36fccfae487e41ded7e29ae678e4ea5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Ijgfvrk.exe
    MD5

    e1032a4d1c87a284617af64f9d29be37

    SHA1

    3e60cab4c29c96edcf30d93e1c55cdeaacfd5c66

    SHA256

    fc7f67995d35e7ce3281ba1e9d1949a068f2d21a9deb67e575c1241f265f63fa

    SHA512

    a1ef68c8e524ae9dda469c384aab4fac94e8c313f961a9c4006a8324d2e098625a95eb2f6309f00b2ad7dc9cf4116f8dc36fccfae487e41ded7e29ae678e4ea5

    Download Submit

  • memory/1580-148-0x000000001BBF0000-0x000000001BBF2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1580-139-0x00007FFA6A453000-0x00007FFA6A455000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1580-138-0x0000000000F80000-0x0000000001004000-memory.dmp

    Filesize

    528KB

    Download

  • memory/3024-135-0x00000000057D0000-0x00000000057DA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3024-130-0x000000007513E000-0x000000007513F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3024-134-0x0000000005660000-0x0000000005661000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3024-133-0x0000000005590000-0x0000000005622000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3024-132-0x0000000004FE0000-0x0000000005584000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3024-131-0x0000000000400000-0x0000000000ACE000-memory.dmp

    Filesize

    6.8MB

    Download

  • memory/3876-142-0x00007FFA8C310000-0x00007FFA8C312000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3876-143-0x00007FF6E6580000-0x00007FF6E75F6000-memory.dmp

    Filesize

    16.5MB

    Download

  • memory/3876-144-0x00007FF6E6580000-0x00007FF6E75F6000-memory.dmp

    Filesize

    16.5MB

    Download

  • memory/3876-145-0x00007FF6E6580000-0x00007FF6E75F6000-memory.dmp

    Filesize

    16.5MB

    Download

  • memory/3876-146-0x00007FF6E6580000-0x00007FF6E75F6000-memory.dmp

    Filesize

    16.5MB

    Download

  • memory/3876-147-0x00007FF6E6580000-0x00007FF6E75F6000-memory.dmp

    Filesize

    16.5MB

    Download

  • memory/3876-149-0x00007FF6E6580000-0x00007FF6E75F6000-memory.dmp

    Filesize

    16.5MB

    Download