Analysis
-
max time kernel
4294203s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
12-03-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe
Resource
win10v2004-20220310-en
General
-
Target
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe
-
Size
454KB
-
MD5
f227f29cfb2aa5df483628e9a13ba879
-
SHA1
bd23442d6ae60d3e3df7dfd6693245f97cd79533
-
SHA256
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a
-
SHA512
930599ce5fa347921885bf4ae2e9c3c621d23f43883e7790b0b380d71a6576ffc74d61f6b6dc02ad7a2ee16f8a7d4b85b436c29068f9f07873a96e69112415e2
Malware Config
Extracted
quasar
3.0
ZenoXpu
185.153.222.198:7845
HIFbOBRX8hIfqiy4wu
-
encryption_key
DQXvqTzM5uyODUsZK174
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1820-66-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1820-68-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1820-70-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1820-75-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1820-73-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
aspnet_compiler.exepid process 1820 aspnet_compiler.exe -
Loads dropped DLL 1 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exepid process 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exedescription pid process target process PID 1472 set thread context of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exepid process 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe Token: SeDebugPrivilege 1820 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exeWScript.exedescription pid process target process PID 1472 wrote to memory of 1944 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 1472 wrote to memory of 1944 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 1472 wrote to memory of 1944 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 1472 wrote to memory of 1944 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1472 wrote to memory of 1820 1472 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 1944 wrote to memory of 928 1944 WScript.exe powershell.exe PID 1944 wrote to memory of 928 1944 WScript.exe powershell.exe PID 1944 wrote to memory of 928 1944 WScript.exe powershell.exe PID 1944 wrote to memory of 928 1944 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe"C:\Users\Admin\AppData\Local\Temp\9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zHuhaouwpfrof.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\3⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeC:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeMD5
1e98e92a982af948ee18ee819a2d8ad1
SHA16cb0bd87815118351e5e32c50b434079dfba255c
SHA256235d3f96a78ce2dad584e6eb1a25fc386b3ae5e332c4d3c56f03b0a4978be778
SHA5126711de2e00462c49852cee03fd8ef720310c4ffa5b3a653c08f2913a6146974f28b8a3b3ff38b3097310852a5aa3b964b77945bcefef3856911eb9acd0e42c6f
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeMD5
1e98e92a982af948ee18ee819a2d8ad1
SHA16cb0bd87815118351e5e32c50b434079dfba255c
SHA256235d3f96a78ce2dad584e6eb1a25fc386b3ae5e332c4d3c56f03b0a4978be778
SHA5126711de2e00462c49852cee03fd8ef720310c4ffa5b3a653c08f2913a6146974f28b8a3b3ff38b3097310852a5aa3b964b77945bcefef3856911eb9acd0e42c6f
-
C:\Users\Admin\AppData\Local\Temp\zHuhaouwpfrof.vbsMD5
570e1760047887d4773c02a7f0c0a9ef
SHA1ea36b58136c15c0c38ca496e5fd55e9de62073dc
SHA256c14774447472f5eec655d2046e6e4930b3bed4877de328d4f8a58416b7144db2
SHA512aeb14674534d2a4cc6d58fe733a4a6085d031f1a45ddad9e3e8fa312879b6cd8a1dff962529639b8ebea98d1ca8a9d42c0893d267696a70c7e9db696980b9ef3
-
\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeMD5
1e98e92a982af948ee18ee819a2d8ad1
SHA16cb0bd87815118351e5e32c50b434079dfba255c
SHA256235d3f96a78ce2dad584e6eb1a25fc386b3ae5e332c4d3c56f03b0a4978be778
SHA5126711de2e00462c49852cee03fd8ef720310c4ffa5b3a653c08f2913a6146974f28b8a3b3ff38b3097310852a5aa3b964b77945bcefef3856911eb9acd0e42c6f
-
memory/928-80-0x0000000073000000-0x00000000735AB000-memory.dmpFilesize
5.7MB
-
memory/1472-54-0x00000000011E0000-0x0000000001258000-memory.dmpFilesize
480KB
-
memory/1472-55-0x0000000074290000-0x000000007497E000-memory.dmpFilesize
6.9MB
-
memory/1472-56-0x0000000000300000-0x0000000000312000-memory.dmpFilesize
72KB
-
memory/1472-57-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/1472-58-0x0000000000980000-0x00000000009A4000-memory.dmpFilesize
144KB
-
memory/1820-66-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-68-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-64-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-70-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-75-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-73-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-62-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1820-78-0x0000000074290000-0x000000007497E000-memory.dmpFilesize
6.9MB
-
memory/1820-79-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1944-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB