Analysis
-
max time kernel
125s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 00:35
Static task
static1
Behavioral task
behavioral1
Sample
d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe
Resource
win7-20220414-en
General
-
Target
d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe
-
Size
1.5MB
-
MD5
f822f2ba51ac484e1e32cabfcf78e240
-
SHA1
5388a244ef7be66d3fc8e58e54c9f44dfc2e6396
-
SHA256
d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c
-
SHA512
671108fcb2b89bc06430df1cdd2ffc95ab9340bd01d394ba1c026b84689e54dadf1ac659852270a14a49d6a22fa6ac8f3192264f51c1c5dd36bc7df9375ee87c
Malware Config
Extracted
quasar
1.3.0.0
Office01
174.139.46.13:4782
QSR_MUTEX_mK2M7xovgh7rCUSa7M
-
encryption_key
0icGYPYyleDgljf1p7Zu
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft Store
-
subdirectory
Windows
Signatures
-
Quasar Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1584-138-0x0000000000B90000-0x0000000000C20000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\dll.exe family_quasar C:\Users\Admin\AppData\Local\Temp\dll.exe family_quasar C:\Users\Admin\AppData\Roaming\Windows\Client.exe family_quasar C:\Users\Admin\AppData\Roaming\Windows\Client.exe family_quasar -
Executes dropped EXE 2 IoCs
Processes:
dll.exeClient.exepid process 1584 dll.exe 952 Client.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2876 schtasks.exe 3944 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
dll.exeClient.exedescription pid process Token: SeDebugPrivilege 1584 dll.exe Token: SeDebugPrivilege 952 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 952 Client.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exedll.exeClient.exedescription pid process target process PID 2308 wrote to memory of 1584 2308 d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe dll.exe PID 2308 wrote to memory of 1584 2308 d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe dll.exe PID 2308 wrote to memory of 1584 2308 d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe dll.exe PID 1584 wrote to memory of 2876 1584 dll.exe schtasks.exe PID 1584 wrote to memory of 2876 1584 dll.exe schtasks.exe PID 1584 wrote to memory of 2876 1584 dll.exe schtasks.exe PID 1584 wrote to memory of 952 1584 dll.exe Client.exe PID 1584 wrote to memory of 952 1584 dll.exe Client.exe PID 1584 wrote to memory of 952 1584 dll.exe Client.exe PID 952 wrote to memory of 3944 952 Client.exe schtasks.exe PID 952 wrote to memory of 3944 952 Client.exe schtasks.exe PID 952 wrote to memory of 3944 952 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe"C:\Users\Admin\AppData\Local\Temp\d9f5f1872cebecbcaa556c1d5371961731a7614fd141ba5040091a6e37b9346c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dll.exe"C:\Users\Admin\AppData\Local\Temp\dll.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Microsoft Store" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\dll.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\Client.exe"C:\Users\Admin\AppData\Roaming\Windows\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Microsoft Store" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\Client.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dll.exeFilesize
548KB
MD555a9c9861d5058eeffa6a7e8f80da7f4
SHA1c18171180b61081a6087bf544c5150a26894896c
SHA2567d53f16a9e5e88e017ed349d718b797fbc6c18cf4b17376bb00a2bb2d6066c6d
SHA512e8ce69aa65dda216b73bf172ab77eb56aa6b49e2117f1531a82001122a316b3454c7dd19d61a01eb480aafea5262319441997d877a11c23d36b0da8d70b3459f
-
C:\Users\Admin\AppData\Local\Temp\dll.exeFilesize
548KB
MD555a9c9861d5058eeffa6a7e8f80da7f4
SHA1c18171180b61081a6087bf544c5150a26894896c
SHA2567d53f16a9e5e88e017ed349d718b797fbc6c18cf4b17376bb00a2bb2d6066c6d
SHA512e8ce69aa65dda216b73bf172ab77eb56aa6b49e2117f1531a82001122a316b3454c7dd19d61a01eb480aafea5262319441997d877a11c23d36b0da8d70b3459f
-
C:\Users\Admin\AppData\Roaming\Windows\Client.exeFilesize
548KB
MD555a9c9861d5058eeffa6a7e8f80da7f4
SHA1c18171180b61081a6087bf544c5150a26894896c
SHA2567d53f16a9e5e88e017ed349d718b797fbc6c18cf4b17376bb00a2bb2d6066c6d
SHA512e8ce69aa65dda216b73bf172ab77eb56aa6b49e2117f1531a82001122a316b3454c7dd19d61a01eb480aafea5262319441997d877a11c23d36b0da8d70b3459f
-
C:\Users\Admin\AppData\Roaming\Windows\Client.exeFilesize
548KB
MD555a9c9861d5058eeffa6a7e8f80da7f4
SHA1c18171180b61081a6087bf544c5150a26894896c
SHA2567d53f16a9e5e88e017ed349d718b797fbc6c18cf4b17376bb00a2bb2d6066c6d
SHA512e8ce69aa65dda216b73bf172ab77eb56aa6b49e2117f1531a82001122a316b3454c7dd19d61a01eb480aafea5262319441997d877a11c23d36b0da8d70b3459f
-
memory/952-145-0x0000000006330000-0x000000000636C000-memory.dmpFilesize
240KB
-
memory/952-142-0x0000000000000000-mapping.dmp
-
memory/1584-140-0x00000000062B0000-0x00000000062C2000-memory.dmpFilesize
72KB
-
memory/1584-135-0x0000000000000000-mapping.dmp
-
memory/1584-138-0x0000000000B90000-0x0000000000C20000-memory.dmpFilesize
576KB
-
memory/1584-139-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/2308-133-0x00000000051D0000-0x00000000051DA000-memory.dmpFilesize
40KB
-
memory/2308-130-0x0000000000600000-0x0000000000790000-memory.dmpFilesize
1.6MB
-
memory/2308-131-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB
-
memory/2308-132-0x0000000005120000-0x00000000051B2000-memory.dmpFilesize
584KB
-
memory/2308-134-0x00000000075F0000-0x000000000768C000-memory.dmpFilesize
624KB
-
memory/2876-141-0x0000000000000000-mapping.dmp
-
memory/3944-146-0x0000000000000000-mapping.dmp