Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
12-03-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe
Resource
win10v2004-20220310-en
General
-
Target
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe
-
Size
454KB
-
MD5
f227f29cfb2aa5df483628e9a13ba879
-
SHA1
bd23442d6ae60d3e3df7dfd6693245f97cd79533
-
SHA256
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a
-
SHA512
930599ce5fa347921885bf4ae2e9c3c621d23f43883e7790b0b380d71a6576ffc74d61f6b6dc02ad7a2ee16f8a7d4b85b436c29068f9f07873a96e69112415e2
Malware Config
Extracted
quasar
3.0
ZenoXpu
185.153.222.198:7845
HIFbOBRX8hIfqiy4wu
-
encryption_key
DQXvqTzM5uyODUsZK174
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1800-142-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral2/memory/1800-147-0x0000000005060000-0x0000000005604000-memory.dmp family_quasar -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Executes dropped EXE 2 IoCs
Processes:
aspnet_compiler.exeaspnet_compiler.exepid process 3124 aspnet_compiler.exe 1800 aspnet_compiler.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation WScript.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 45 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exedescription pid process target process PID 4332 set thread context of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exepowershell.exepid process 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe 2424 powershell.exe 2424 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exepowershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 1800 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exeWScript.exedescription pid process target process PID 4332 wrote to memory of 864 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 4332 wrote to memory of 864 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 4332 wrote to memory of 864 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe WScript.exe PID 4332 wrote to memory of 3124 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 3124 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 3124 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 4332 wrote to memory of 1800 4332 9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe aspnet_compiler.exe PID 864 wrote to memory of 2424 864 WScript.exe powershell.exe PID 864 wrote to memory of 2424 864 WScript.exe powershell.exe PID 864 wrote to memory of 2424 864 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe"C:\Users\Admin\AppData\Local\Temp\9df4e1f2aca6df41008c405008749423352533359efba8e5ca865bf8f1f5cb8a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\zHuhaouwpfrof.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeC:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe2⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeC:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeMD5
fda8c8f2a4e100afb14c13dfcbcab2d2
SHA119dfd86294c4a525ba21c6af77681b2a9bbecb55
SHA25699a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09
SHA51294f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeMD5
fda8c8f2a4e100afb14c13dfcbcab2d2
SHA119dfd86294c4a525ba21c6af77681b2a9bbecb55
SHA25699a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09
SHA51294f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeMD5
fda8c8f2a4e100afb14c13dfcbcab2d2
SHA119dfd86294c4a525ba21c6af77681b2a9bbecb55
SHA25699a2c778c9a6486639d0aff1a7d2d494c2b0dc4c7913ebcb7bfea50a2f1d0b09
SHA51294f0ace37cae77be9935cf4fc8aaa94691343d3b38de5e16c663b902c220bff513cd02256c7af2d815a23dd30439582ddbb0880009c76bbf36ff8fbc1a6ddc18
-
C:\Users\Admin\AppData\Local\Temp\zHuhaouwpfrof.vbsMD5
570e1760047887d4773c02a7f0c0a9ef
SHA1ea36b58136c15c0c38ca496e5fd55e9de62073dc
SHA256c14774447472f5eec655d2046e6e4930b3bed4877de328d4f8a58416b7144db2
SHA512aeb14674534d2a4cc6d58fe733a4a6085d031f1a45ddad9e3e8fa312879b6cd8a1dff962529639b8ebea98d1ca8a9d42c0893d267696a70c7e9db696980b9ef3
-
memory/1800-146-0x0000000005100000-0x0000000005192000-memory.dmpFilesize
584KB
-
memory/1800-145-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB
-
memory/1800-157-0x0000000006420000-0x000000000645C000-memory.dmpFilesize
240KB
-
memory/1800-156-0x0000000006000000-0x0000000006012000-memory.dmpFilesize
72KB
-
memory/1800-142-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1800-152-0x00000000052D0000-0x0000000005336000-memory.dmpFilesize
408KB
-
memory/1800-147-0x0000000005060000-0x0000000005604000-memory.dmpFilesize
5.6MB
-
memory/2424-154-0x0000000005D20000-0x0000000005D42000-memory.dmpFilesize
136KB
-
memory/2424-155-0x0000000005D80000-0x0000000005DE6000-memory.dmpFilesize
408KB
-
memory/2424-158-0x0000000005E40000-0x0000000005E5E000-memory.dmpFilesize
120KB
-
memory/2424-149-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/2424-148-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB
-
memory/2424-150-0x0000000002B10000-0x0000000002B46000-memory.dmpFilesize
216KB
-
memory/2424-151-0x0000000002B52000-0x0000000002B53000-memory.dmpFilesize
4KB
-
memory/2424-153-0x0000000005500000-0x0000000005B28000-memory.dmpFilesize
6.2MB
-
memory/4332-136-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/4332-139-0x0000000005C70000-0x0000000005C8E000-memory.dmpFilesize
120KB
-
memory/4332-134-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB
-
memory/4332-137-0x0000000005CA0000-0x0000000006244000-memory.dmpFilesize
5.6MB
-
memory/4332-138-0x00000000059B0000-0x0000000005A26000-memory.dmpFilesize
472KB
-
memory/4332-135-0x0000000000C70000-0x0000000000CE8000-memory.dmpFilesize
480KB