Analysis
-
max time kernel
136s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2023 08:27
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220901-en
General
-
Target
tmp.exe
-
Size
17KB
-
MD5
f6f83ba3f1e87503941e50b3e50d390f
-
SHA1
6983d00bc9cda93f0da126504d99a851ffef6cea
-
SHA256
3fb34d34eaa6800dce2dce585ec89a9b3f98637c624c8774945af5ad8a37a3e8
-
SHA512
d9afb2024c16229d1245d1c8faf1a5fb7b1c2a4c2e379078e0c70493c8dedc7fb76be3233c4e9757168382b27b8ae4f17726209af893297fe67838472443e3d4
-
SSDEEP
384:O0CqWx4t+dWNzuY7/aAygucwhb6v/uFi:O0CL4sBTguJmei
Malware Config
Extracted
quasar
1.4.0.0
Office04
51.89.157.248:4782
MvfU8Y7jQptTEqcSWG
-
encryption_key
gfcyUhYEMEq5BWNn8aVX
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3692-147-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverHelp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverHelp.exe\"" tmp.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 400 set thread context of 3692 400 tmp.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2064 powershell.exe 2064 powershell.exe 2228 powershell.exe 2228 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
tmp.exepowershell.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 400 tmp.exe Token: SeDebugPrivilege 2064 powershell.exe Token: SeDebugPrivilege 2228 powershell.exe Token: SeDebugPrivilege 3692 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 3692 RegAsm.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
tmp.execmd.exedescription pid process target process PID 400 wrote to memory of 2064 400 tmp.exe powershell.exe PID 400 wrote to memory of 2064 400 tmp.exe powershell.exe PID 400 wrote to memory of 2064 400 tmp.exe powershell.exe PID 400 wrote to memory of 4400 400 tmp.exe cmd.exe PID 400 wrote to memory of 4400 400 tmp.exe cmd.exe PID 400 wrote to memory of 4400 400 tmp.exe cmd.exe PID 4400 wrote to memory of 2228 4400 cmd.exe powershell.exe PID 4400 wrote to memory of 2228 4400 cmd.exe powershell.exe PID 4400 wrote to memory of 2228 4400 cmd.exe powershell.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe PID 400 wrote to memory of 3692 400 tmp.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD56195a91754effb4df74dbc72cdf4f7a6
SHA1aba262f5726c6d77659fe0d3195e36a85046b427
SHA2563254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
SHA512ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5cf7e8e073ac6490d693e7910c57f23f0
SHA1d6a03f22a641bc5a7eadeb9d60849fdfa36f704d
SHA2568b9913410404127bb7aa63fe1e71ffd3d19ef02644ab077df9181a7f788943ef
SHA51258caf94e359ed8dc7de1dea120f3c039546cbed8aefa462cc265553b0b910452b89a2801758ed7c04fc8bfd6c5c9daf9dce7cb7dfd987d7fbd58516ed15600dd
-
memory/400-133-0x0000000005CF0000-0x0000000005D12000-memory.dmpFilesize
136KB
-
memory/400-132-0x0000000000670000-0x000000000067A000-memory.dmpFilesize
40KB
-
memory/2064-138-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/2064-137-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/2064-139-0x0000000006360000-0x000000000637E000-memory.dmpFilesize
120KB
-
memory/2064-140-0x0000000007BB0000-0x000000000822A000-memory.dmpFilesize
6.5MB
-
memory/2064-141-0x0000000006870000-0x000000000688A000-memory.dmpFilesize
104KB
-
memory/2064-136-0x0000000005460000-0x0000000005A88000-memory.dmpFilesize
6.2MB
-
memory/2064-135-0x0000000004D90000-0x0000000004DC6000-memory.dmpFilesize
216KB
-
memory/2064-134-0x0000000000000000-mapping.dmp
-
memory/2228-153-0x0000000006120000-0x000000000613E000-memory.dmpFilesize
120KB
-
memory/2228-154-0x0000000006F10000-0x0000000006F1A000-memory.dmpFilesize
40KB
-
memory/2228-161-0x00000000070B0000-0x00000000070B8000-memory.dmpFilesize
32KB
-
memory/2228-160-0x00000000070D0000-0x00000000070EA000-memory.dmpFilesize
104KB
-
memory/2228-159-0x0000000005A00000-0x0000000005A0E000-memory.dmpFilesize
56KB
-
memory/2228-143-0x0000000000000000-mapping.dmp
-
memory/2228-151-0x0000000006BA0000-0x0000000006BD2000-memory.dmpFilesize
200KB
-
memory/2228-152-0x0000000071A40000-0x0000000071A8C000-memory.dmpFilesize
304KB
-
memory/2228-155-0x0000000007150000-0x00000000071E6000-memory.dmpFilesize
600KB
-
memory/3692-146-0x0000000000000000-mapping.dmp
-
memory/3692-156-0x0000000006000000-0x0000000006012000-memory.dmpFilesize
72KB
-
memory/3692-157-0x0000000006420000-0x000000000645C000-memory.dmpFilesize
240KB
-
memory/3692-158-0x0000000006790000-0x000000000679A000-memory.dmpFilesize
40KB
-
memory/3692-149-0x0000000005160000-0x00000000051F2000-memory.dmpFilesize
584KB
-
memory/3692-148-0x0000000005590000-0x0000000005B34000-memory.dmpFilesize
5.6MB
-
memory/3692-147-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4400-142-0x0000000000000000-mapping.dmp