Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 04:53
Static task
static1
Behavioral task
behavioral1
Sample
f6f83ba3f1e87503941e50b3e50d390f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f6f83ba3f1e87503941e50b3e50d390f.exe
Resource
win10v2004-20221111-en
General
-
Target
f6f83ba3f1e87503941e50b3e50d390f.exe
-
Size
17KB
-
MD5
f6f83ba3f1e87503941e50b3e50d390f
-
SHA1
6983d00bc9cda93f0da126504d99a851ffef6cea
-
SHA256
3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8
-
SHA512
d9afb2024c16229d1245d1c8faf1a5fb7b1c2a4c2e379078e0c70493c8dedc7fb76be3233c4e9757168382b27b8ae4f17726209af893297fe67838472443e3d4
-
SSDEEP
384:O0CqWx4t+dWNzuY7/aAygucwhb6v/uFi:O0CL4sBTguJmei
Malware Config
Extracted
quasar
1.4.0.0
Office04
51.89.157.248:4782
MvfU8Y7jQptTEqcSWG
-
encryption_key
gfcyUhYEMEq5BWNn8aVX
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1064-146-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f6f83ba3f1e87503941e50b3e50d390f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation f6f83ba3f1e87503941e50b3e50d390f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f6f83ba3f1e87503941e50b3e50d390f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverHelp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverHelp.exe\"" f6f83ba3f1e87503941e50b3e50d390f.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 21 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f6f83ba3f1e87503941e50b3e50d390f.exedescription pid process target process PID 4652 set thread context of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 5040 powershell.exe 5040 powershell.exe 2852 powershell.exe 2852 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
f6f83ba3f1e87503941e50b3e50d390f.exepowershell.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4652 f6f83ba3f1e87503941e50b3e50d390f.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 2852 powershell.exe Token: SeDebugPrivilege 1064 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1064 RegAsm.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f6f83ba3f1e87503941e50b3e50d390f.execmd.exedescription pid process target process PID 4652 wrote to memory of 5040 4652 f6f83ba3f1e87503941e50b3e50d390f.exe powershell.exe PID 4652 wrote to memory of 5040 4652 f6f83ba3f1e87503941e50b3e50d390f.exe powershell.exe PID 4652 wrote to memory of 5040 4652 f6f83ba3f1e87503941e50b3e50d390f.exe powershell.exe PID 4652 wrote to memory of 2640 4652 f6f83ba3f1e87503941e50b3e50d390f.exe cmd.exe PID 4652 wrote to memory of 2640 4652 f6f83ba3f1e87503941e50b3e50d390f.exe cmd.exe PID 4652 wrote to memory of 2640 4652 f6f83ba3f1e87503941e50b3e50d390f.exe cmd.exe PID 2640 wrote to memory of 2852 2640 cmd.exe powershell.exe PID 2640 wrote to memory of 2852 2640 cmd.exe powershell.exe PID 2640 wrote to memory of 2852 2640 cmd.exe powershell.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe PID 4652 wrote to memory of 1064 4652 f6f83ba3f1e87503941e50b3e50d390f.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6f83ba3f1e87503941e50b3e50d390f.exe"C:\Users\Admin\AppData\Local\Temp\f6f83ba3f1e87503941e50b3e50d390f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5a57a8a4b059139a91487d5abfc50afa1
SHA1efda38603c53adf419f09faca0e975bd97f044a4
SHA25621f356bc513114b6c139ea7872ad3b2e37e6a36804bc3cbe6b8f1b79251a406d
SHA5124ec0d7bc736b282216ea2f88b22485365016511280d9abff4bb5ba2dcfb9842349bbd197e42984d203eabf57896fd544b68f722d39c595890f75a7e4266eabbd
-
memory/1064-158-0x0000000006010000-0x000000000601A000-memory.dmpFilesize
40KB
-
memory/1064-156-0x0000000005CA0000-0x0000000005CDC000-memory.dmpFilesize
240KB
-
memory/1064-155-0x0000000005860000-0x0000000005872000-memory.dmpFilesize
72KB
-
memory/1064-149-0x0000000004930000-0x00000000049C2000-memory.dmpFilesize
584KB
-
memory/1064-148-0x0000000004E30000-0x00000000053D4000-memory.dmpFilesize
5.6MB
-
memory/1064-146-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1064-145-0x0000000000000000-mapping.dmp
-
memory/2640-142-0x0000000000000000-mapping.dmp
-
memory/2852-153-0x0000000006C40000-0x0000000006C5E000-memory.dmpFilesize
120KB
-
memory/2852-154-0x0000000007A40000-0x0000000007A4A000-memory.dmpFilesize
40KB
-
memory/2852-161-0x0000000007BE0000-0x0000000007BE8000-memory.dmpFilesize
32KB
-
memory/2852-160-0x0000000007C00000-0x0000000007C1A000-memory.dmpFilesize
104KB
-
memory/2852-159-0x0000000006570000-0x000000000657E000-memory.dmpFilesize
56KB
-
memory/2852-143-0x0000000000000000-mapping.dmp
-
memory/2852-157-0x0000000007C80000-0x0000000007D16000-memory.dmpFilesize
600KB
-
memory/2852-151-0x0000000006C70000-0x0000000006CA2000-memory.dmpFilesize
200KB
-
memory/2852-152-0x0000000071060000-0x00000000710AC000-memory.dmpFilesize
304KB
-
memory/4652-133-0x0000000005D50000-0x0000000005D72000-memory.dmpFilesize
136KB
-
memory/4652-132-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/5040-138-0x0000000005E10000-0x0000000005E76000-memory.dmpFilesize
408KB
-
memory/5040-135-0x0000000002B10000-0x0000000002B46000-memory.dmpFilesize
216KB
-
memory/5040-134-0x0000000000000000-mapping.dmp
-
memory/5040-136-0x00000000055D0000-0x0000000005BF8000-memory.dmpFilesize
6.2MB
-
memory/5040-137-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/5040-139-0x0000000006440000-0x000000000645E000-memory.dmpFilesize
120KB
-
memory/5040-140-0x0000000007C90000-0x000000000830A000-memory.dmpFilesize
6.5MB
-
memory/5040-141-0x0000000006940000-0x000000000695A000-memory.dmpFilesize
104KB