Analysis
-
max time kernel
150s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 08:43
Static task
static1
Behavioral task
behavioral1
Sample
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe
Resource
win10v2004-20220812-en
General
-
Target
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe
-
Size
2.8MB
-
MD5
fcf74d4566afb934f07dd834f808c91a
-
SHA1
40ca32e4a614421f6af5afadf51d1cce1a0c64d3
-
SHA256
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
-
SHA512
54000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
SSDEEP
6144:De40VFabAt0nvrzCy1GdWEufANJoXiEmJARab8rK5AzVvjn/qK/k8eEJaQXHIQJG:De3Fab
Malware Config
Extracted
quasar
1.3.0.0
Retards
192.227.223.11:7707
QSR_MUTEX_f16UjmYVpgK3aDIQD0
-
encryption_key
76BTYMCCLlIx8oiGPHIG
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsWMI
-
subdirectory
SubDir
Signatures
-
Quasar payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1228-61-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar behavioral1/memory/1228-62-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar behavioral1/memory/1228-63-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar behavioral1/memory/1228-64-0x000000000045818E-mapping.dmp family_quasar behavioral1/memory/1228-68-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar behavioral1/memory/1228-66-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar behavioral1/memory/916-135-0x000000000045818E-mapping.dmp family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Client.exeClient.exepid process 1068 Client.exe 916 Client.exe -
Loads dropped DLL 6 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exeWerFault.exepid process 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1068 Client.exe 668 WerFault.exe 668 WerFault.exe 668 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Client.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsWMI = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\"" Client.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exepid process 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1068 Client.exe 1068 Client.exe 1068 Client.exe 1068 Client.exe 1068 Client.exe 1068 Client.exe 1068 Client.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exedescription pid process target process PID 1012 set thread context of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1068 set thread context of 916 1068 Client.exe Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 668 1068 WerFault.exe Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 860 timeout.exe 1348 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exepid process 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 1068 Client.exe 1068 Client.exe 1068 Client.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exeClient.exedescription pid process Token: SeDebugPrivilege 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Token: SeDebugPrivilege 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Token: SeDebugPrivilege 1068 Client.exe Token: SeDebugPrivilege 916 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 916 Client.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.execmd.exe4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.execmd.exeClient.exedescription pid process target process PID 1012 wrote to memory of 1752 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 1012 wrote to memory of 1752 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 1012 wrote to memory of 1752 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 1012 wrote to memory of 1752 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 1752 wrote to memory of 860 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 860 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 860 1752 cmd.exe timeout.exe PID 1752 wrote to memory of 860 1752 cmd.exe timeout.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1012 wrote to memory of 1228 1012 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 1228 wrote to memory of 624 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 1228 wrote to memory of 624 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 1228 wrote to memory of 624 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 1228 wrote to memory of 624 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 1228 wrote to memory of 1068 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 1228 wrote to memory of 1068 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 1228 wrote to memory of 1068 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 1228 wrote to memory of 1068 1228 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 1068 wrote to memory of 1604 1068 Client.exe cmd.exe PID 1068 wrote to memory of 1604 1068 Client.exe cmd.exe PID 1068 wrote to memory of 1604 1068 Client.exe cmd.exe PID 1068 wrote to memory of 1604 1068 Client.exe cmd.exe PID 1604 wrote to memory of 1348 1604 cmd.exe timeout.exe PID 1604 wrote to memory of 1348 1604 cmd.exe timeout.exe PID 1604 wrote to memory of 1348 1604 cmd.exe timeout.exe PID 1604 wrote to memory of 1348 1604 cmd.exe timeout.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 916 1068 Client.exe Client.exe PID 1068 wrote to memory of 668 1068 Client.exe WerFault.exe PID 1068 wrote to memory of 668 1068 Client.exe WerFault.exe PID 1068 wrote to memory of 668 1068 Client.exe WerFault.exe PID 1068 wrote to memory of 668 1068 Client.exe WerFault.exe PID 916 wrote to memory of 1916 916 Client.exe schtasks.exe PID 916 wrote to memory of 1916 916 Client.exe schtasks.exe PID 916 wrote to memory of 1916 916 Client.exe schtasks.exe PID 916 wrote to memory of 1916 916 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:860 -
C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsWMI" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:624 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:1348 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsWMI" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:1916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 8404⤵
- Loads dropped DLL
- Program crash
PID:668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
memory/624-119-0x0000000000000000-mapping.dmp
-
memory/668-142-0x0000000000000000-mapping.dmp
-
memory/860-57-0x0000000000000000-mapping.dmp
-
memory/916-135-0x000000000045818E-mapping.dmp
-
memory/1012-54-0x0000000000930000-0x0000000000C0A000-memory.dmpFilesize
2.9MB
-
memory/1012-69-0x0000000000490000-0x00000000004A0000-memory.dmpFilesize
64KB
-
memory/1012-55-0x00000000020C0000-0x000000000212C000-memory.dmpFilesize
432KB
-
memory/1068-125-0x0000000000B60000-0x0000000000E3A000-memory.dmpFilesize
2.9MB
-
memory/1068-122-0x0000000000000000-mapping.dmp
-
memory/1228-62-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1228-84-0x00000000763F1000-0x00000000763F3000-memory.dmpFilesize
8KB
-
memory/1228-66-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1228-68-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1228-64-0x000000000045818E-mapping.dmp
-
memory/1228-63-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1228-61-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1228-59-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1228-58-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/1348-127-0x0000000000000000-mapping.dmp
-
memory/1604-126-0x0000000000000000-mapping.dmp
-
memory/1752-56-0x0000000000000000-mapping.dmp
-
memory/1916-146-0x0000000000000000-mapping.dmp