Analysis
-
max time kernel
91s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2023 16:16
Static task
static1
Behavioral task
behavioral1
Sample
BLToolsMod.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
BLToolsMod.exe
Resource
win10v2004-20220901-en
General
-
Target
BLToolsMod.exe
-
Size
763KB
-
MD5
869037e716218fb7551d84b8ce7d0ae7
-
SHA1
12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18
-
SHA256
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6
-
SHA512
6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2
-
SSDEEP
12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4
Malware Config
Extracted
quasar
1.4.0.0
Office04
youhackernetpaingodxd.duckdns.org:5557
blablashitspreading.ddns.net:5557
xEoEv3HHdyEIYwJRFM
-
encryption_key
w3WfcmWh1iXT9cxeKFEX
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1140-147-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BLToolsMod.exeUpdater-File.exeRegAsm.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation BLToolsMod.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Updater-File.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 1 IoCs
Processes:
Updater-File.exepid process 4636 Updater-File.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Updater-File.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Driver.exe\"" Updater-File.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 37 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Updater-File.exedescription pid process target process PID 4636 set thread context of 1140 4636 Updater-File.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1356 3376 WerFault.exe BLToolsMod.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1704 powershell.exe 1704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
BLToolsMod.exeUpdater-File.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3376 BLToolsMod.exe Token: SeDebugPrivilege 4636 Updater-File.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 1140 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1140 RegAsm.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
BLToolsMod.exeUpdater-File.exeRegAsm.execmd.exedescription pid process target process PID 3376 wrote to memory of 4636 3376 BLToolsMod.exe Updater-File.exe PID 3376 wrote to memory of 4636 3376 BLToolsMod.exe Updater-File.exe PID 3376 wrote to memory of 4636 3376 BLToolsMod.exe Updater-File.exe PID 4636 wrote to memory of 1704 4636 Updater-File.exe powershell.exe PID 4636 wrote to memory of 1704 4636 Updater-File.exe powershell.exe PID 4636 wrote to memory of 1704 4636 Updater-File.exe powershell.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 4636 wrote to memory of 1140 4636 Updater-File.exe RegAsm.exe PID 1140 wrote to memory of 4544 1140 RegAsm.exe cmd.exe PID 1140 wrote to memory of 4544 1140 RegAsm.exe cmd.exe PID 1140 wrote to memory of 4544 1140 RegAsm.exe cmd.exe PID 4544 wrote to memory of 3700 4544 cmd.exe chcp.com PID 4544 wrote to memory of 3700 4544 cmd.exe chcp.com PID 4544 wrote to memory of 3700 4544 cmd.exe chcp.com PID 4544 wrote to memory of 4584 4544 cmd.exe PING.EXE PID 4544 wrote to memory of 4584 4544 cmd.exe PING.EXE PID 4544 wrote to memory of 4584 4544 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"C:\Users\Admin\AppData\Local\Temp\BLToolsMod.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Updater-File.exe"C:\Users\Admin\AppData\Roaming\Updater-File.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MsYYveiMG7iU.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 20962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3376 -ip 33761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MsYYveiMG7iU.batFilesize
270B
MD55ebfd51bdc4b72d54bc91ac8a6065e98
SHA15d46152b2a9033f09edd49c77829203f35e20584
SHA2561372936306530f91e7459f31ee483188bf28a7c481a59a6805133f09d349906f
SHA512a19e148f3be56ee6d2042769f8be73e1cb0600473d3fae346779f98fe09b909e7cb8267e7fa2bb358e0cd7d93806abd260860044f097e0d885e93996f0cd5c49
-
C:\Users\Admin\AppData\Roaming\Logs\02-05-~1Filesize
224B
MD5f81fec59640307ba7b3202172d206729
SHA1ab90c240b8c3b23a6c06c119a028903a58afce3d
SHA256e79eb0a2f9b56966a8336200336123baffad193e193fed675f4eba468cb30d0f
SHA512397ebf45d2fa62a956443546de0c33fd254bc3891fc6159172790bbc0fcaf320f4ada3ea14fe1c0d94a696716bdb640a055fe2cd2275e3f268569febb276d1cd
-
C:\Users\Admin\AppData\Roaming\Updater-File.exeFilesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b
-
C:\Users\Admin\AppData\Roaming\Updater-File.exeFilesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b
-
memory/1140-146-0x0000000000000000-mapping.dmp
-
memory/1140-152-0x0000000006610000-0x000000000661A000-memory.dmpFilesize
40KB
-
memory/1140-151-0x00000000062A0000-0x00000000062DC000-memory.dmpFilesize
240KB
-
memory/1140-150-0x00000000056B0000-0x00000000056C2000-memory.dmpFilesize
72KB
-
memory/1140-149-0x0000000005140000-0x00000000051D2000-memory.dmpFilesize
584KB
-
memory/1140-148-0x00000000056F0000-0x0000000005C94000-memory.dmpFilesize
5.6MB
-
memory/1140-147-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1704-138-0x0000000000000000-mapping.dmp
-
memory/1704-139-0x0000000004940000-0x0000000004976000-memory.dmpFilesize
216KB
-
memory/1704-145-0x00000000063E0000-0x00000000063FA000-memory.dmpFilesize
104KB
-
memory/1704-143-0x0000000005ED0000-0x0000000005EEE000-memory.dmpFilesize
120KB
-
memory/1704-142-0x0000000005850000-0x00000000058B6000-memory.dmpFilesize
408KB
-
memory/1704-141-0x00000000057E0000-0x0000000005846000-memory.dmpFilesize
408KB
-
memory/1704-140-0x00000000050A0000-0x00000000056C8000-memory.dmpFilesize
6.2MB
-
memory/1704-144-0x0000000007520000-0x0000000007B9A000-memory.dmpFilesize
6.5MB
-
memory/3376-132-0x0000000000C50000-0x0000000000D14000-memory.dmpFilesize
784KB
-
memory/3700-155-0x0000000000000000-mapping.dmp
-
memory/4544-153-0x0000000000000000-mapping.dmp
-
memory/4584-156-0x0000000000000000-mapping.dmp
-
memory/4636-137-0x0000000006840000-0x0000000006862000-memory.dmpFilesize
136KB
-
memory/4636-136-0x0000000000C30000-0x0000000000C38000-memory.dmpFilesize
32KB
-
memory/4636-133-0x0000000000000000-mapping.dmp