Analysis
-
max time kernel
137s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:43
Static task
static1
Behavioral task
behavioral1
Sample
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe
Resource
win10v2004-20220812-en
General
-
Target
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe
-
Size
2.8MB
-
MD5
fcf74d4566afb934f07dd834f808c91a
-
SHA1
40ca32e4a614421f6af5afadf51d1cce1a0c64d3
-
SHA256
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
-
SHA512
54000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
SSDEEP
6144:De40VFabAt0nvrzCy1GdWEufANJoXiEmJARab8rK5AzVvjn/qK/k8eEJaQXHIQJG:De3Fab
Malware Config
Extracted
quasar
1.3.0.0
Retards
192.227.223.11:7707
QSR_MUTEX_f16UjmYVpgK3aDIQD0
-
encryption_key
76BTYMCCLlIx8oiGPHIG
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
WindowsWMI
-
subdirectory
SubDir
Signatures
-
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeflow ioc 12 ip-api.com 21 api.ipify.org 37 api.ipify.org Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4724-140-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Client.exeClient.exepid process 5064 Client.exe 1732 Client.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Client.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsWMI = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe\"" 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ip-api.com 21 api.ipify.org 37 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exepid process 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exedescription pid process target process PID 2772 set thread context of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 5064 set thread context of 1732 5064 Client.exe Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1852 2772 WerFault.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2804 5064 WerFault.exe Client.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4012 schtasks.exe 3456 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 4764 timeout.exe 3292 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exepid process 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 5064 Client.exe 5064 Client.exe 5064 Client.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.exeClient.exedescription pid process Token: SeDebugPrivilege 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Token: SeDebugPrivilege 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Token: SeDebugPrivilege 5064 Client.exe Token: SeDebugPrivilege 1732 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 1732 Client.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.execmd.exe4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exeClient.execmd.exeClient.exedescription pid process target process PID 2772 wrote to memory of 4160 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 2772 wrote to memory of 4160 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 2772 wrote to memory of 4160 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe cmd.exe PID 4160 wrote to memory of 4764 4160 cmd.exe timeout.exe PID 4160 wrote to memory of 4764 4160 cmd.exe timeout.exe PID 4160 wrote to memory of 4764 4160 cmd.exe timeout.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 2772 wrote to memory of 4724 2772 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe PID 4724 wrote to memory of 4012 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 4724 wrote to memory of 4012 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 4724 wrote to memory of 4012 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe schtasks.exe PID 4724 wrote to memory of 5064 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 4724 wrote to memory of 5064 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 4724 wrote to memory of 5064 4724 4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe Client.exe PID 5064 wrote to memory of 320 5064 Client.exe cmd.exe PID 5064 wrote to memory of 320 5064 Client.exe cmd.exe PID 5064 wrote to memory of 320 5064 Client.exe cmd.exe PID 320 wrote to memory of 3292 320 cmd.exe timeout.exe PID 320 wrote to memory of 3292 320 cmd.exe timeout.exe PID 320 wrote to memory of 3292 320 cmd.exe timeout.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 5064 wrote to memory of 1732 5064 Client.exe Client.exe PID 1732 wrote to memory of 3456 1732 Client.exe schtasks.exe PID 1732 wrote to memory of 3456 1732 Client.exe schtasks.exe PID 1732 wrote to memory of 3456 1732 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"1⤵
- Quasar RAT
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsWMI" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4012 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:3292 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsWMI" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:3456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 11044⤵
- Program crash
PID:2804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 15282⤵
- Program crash
PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2772 -ip 27721⤵PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5064 -ip 50641⤵PID:1832
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.8MB
MD5fcf74d4566afb934f07dd834f808c91a
SHA140ca32e4a614421f6af5afadf51d1cce1a0c64d3
SHA2564ab5809ad43e54f714e728a03b085a38c2d94c918d5f65404983d4a367f07f8b
SHA51254000e92b69597b158ca3f7c65e49fc705f8439e34092abf7b6df6c085d02343f339be6ad22c784a2f23dcea73b7252d8dd589618faf20a9d8c085ae54c81585
-
memory/320-147-0x0000000000000000-mapping.dmp
-
memory/1732-149-0x0000000000000000-mapping.dmp
-
memory/2772-133-0x00000000053B0000-0x000000000544C000-memory.dmpFilesize
624KB
-
memory/2772-134-0x0000000005B00000-0x00000000060A4000-memory.dmpFilesize
5.6MB
-
memory/2772-135-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB
-
memory/2772-136-0x0000000005360000-0x000000000536A000-memory.dmpFilesize
40KB
-
memory/2772-132-0x0000000000750000-0x0000000000A2A000-memory.dmpFilesize
2.9MB
-
memory/3292-148-0x0000000000000000-mapping.dmp
-
memory/3456-152-0x0000000000000000-mapping.dmp
-
memory/4012-143-0x0000000000000000-mapping.dmp
-
memory/4160-137-0x0000000000000000-mapping.dmp
-
memory/4724-142-0x00000000062F0000-0x0000000006302000-memory.dmpFilesize
72KB
-
memory/4724-141-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/4724-140-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/4724-139-0x0000000000000000-mapping.dmp
-
memory/4764-138-0x0000000000000000-mapping.dmp
-
memory/5064-144-0x0000000000000000-mapping.dmp