Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 14:59

General

  • Target

    invoice554684093903ye74674.exe

  • Size

    214KB

  • MD5

    7658e4288d97431e0b22ee17ce907162

  • SHA1

    2a7b17759b037e3cd4799f9bdb099256197b94d1

  • SHA256

    4ed20217d84f7055b14abf31f97802c5f97b304b147f4d4132c0c1be177e3ff0

  • SHA512

    51553c9b0d335c9a7a9591bc29c4171549405f011b8b9f8663b00e97d832685c1153bc69443eeb3c7ab598d0f8d3e4ac8f60dad10a8e5f7e4a15947502bafc00

  • SSDEEP

    3072:P8oVzkyxfZoB5aDx+Y6HRUHmzhxlI35MNzFNub2h/DWih/H3GR:P8A4HvIdHehj7ubg/Phf3

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Godbless my Hustle

C2

mill.hopto.org:7773

Mutex

QSR_MUTEX_IYpAlOHqocnX5nf6J7

Attributes
  • encryption_key

    4AVo5Pq15qMZSQfQWCXf

  • install_name

    Client.exe

  • log_directory

    Ll

  • reconnect_delay

    123

  • startup_key

    str

  • subdirectory

    SubDir

Extracted

Family

nanocore

Version

1.2.2.0

C2

mill.hopto.org:4489

127.0.0.1:4489

Mutex

f26f6140-1dcf-4d19-b29d-e8b4eda43999

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2022-07-03T15:17:26.062415736Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4489

  • default_group

    Heavenly

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    f26f6140-1dcf-4d19-b29d-e8b4eda43999

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    mill.hopto.org

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\invoice554684093903ye74674.exe
    "C:\Users\Admin\AppData\Local\Temp\invoice554684093903ye74674.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4444
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "str" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Server.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4780
    • C:\Users\Admin\AppData\Local\Temp\invoice554684093903ye74674.exe
      "C:\Users\Admin\AppData\Local\Temp\invoice554684093903ye74674.exe"
      2⤵
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:944

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\invoice554684093903ye74674.exe.log
    Filesize

    944B

    MD5

    564716eed1d687a11ed72a316def6481

    SHA1

    c2423fc47318cd25ecfab00cff85179cba4a9e01

    SHA256

    636987560bea08b7ef5fd1886fd9b37e7d56aa7aa3ecb2b5d41129ae9150f615

    SHA512

    052a4405491981896103c1fad4fb3ce36b1a1a0ed21802e1aba58164580b10baef1ea2d8cc1384578a9b67392cf9bb1f9c4d006eca3794178e01457ce42dd761

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    Filesize

    348KB

    MD5

    42501e281de15d0331a70d0b34b94b8b

    SHA1

    c9ae2a74d0e25e0d2c4946917767d46d33e208cc

    SHA256

    b85d366a889518edf0a9899e2120de042965a72fc60c8795a2f9bd6eee96d58c

    SHA512

    aaea1b070c6560264d2875b7fb355820af4ceab172ff4c5a6b21d893ec4955419c7b673bedae66beae5626dbbacf1c6fe7860008b49029275016c4ac97392f74

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    Filesize

    348KB

    MD5

    42501e281de15d0331a70d0b34b94b8b

    SHA1

    c9ae2a74d0e25e0d2c4946917767d46d33e208cc

    SHA256

    b85d366a889518edf0a9899e2120de042965a72fc60c8795a2f9bd6eee96d58c

    SHA512

    aaea1b070c6560264d2875b7fb355820af4ceab172ff4c5a6b21d893ec4955419c7b673bedae66beae5626dbbacf1c6fe7860008b49029275016c4ac97392f74

  • memory/944-140-0x0000000000000000-mapping.dmp
  • memory/944-143-0x0000000005220000-0x000000000522A000-memory.dmp
    Filesize

    40KB

  • memory/944-141-0x0000000000400000-0x000000000047C000-memory.dmp
    Filesize

    496KB

  • memory/2148-136-0x0000000005D80000-0x0000000005E1C000-memory.dmp
    Filesize

    624KB

  • memory/2148-132-0x00000000009C0000-0x00000000009FC000-memory.dmp
    Filesize

    240KB

  • memory/4444-139-0x0000000005740000-0x00000000057D2000-memory.dmp
    Filesize

    584KB

  • memory/4444-138-0x0000000005CF0000-0x0000000006294000-memory.dmp
    Filesize

    5.6MB

  • memory/4444-137-0x0000000000E10000-0x0000000000E6E000-memory.dmp
    Filesize

    376KB

  • memory/4444-133-0x0000000000000000-mapping.dmp
  • memory/4444-144-0x00000000057E0000-0x0000000005846000-memory.dmp
    Filesize

    408KB

  • memory/4444-145-0x0000000005CD0000-0x0000000005CE2000-memory.dmp
    Filesize

    72KB

  • memory/4444-146-0x0000000006B30000-0x0000000006B6C000-memory.dmp
    Filesize

    240KB

  • memory/4780-147-0x0000000000000000-mapping.dmp