Analysis
-
max time kernel
121s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05-02-2023 16:52
Static task
static1
Behavioral task
behavioral1
Sample
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe
Resource
win10v2004-20221111-en
General
-
Target
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe
-
Size
763KB
-
MD5
869037e716218fb7551d84b8ce7d0ae7
-
SHA1
12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18
-
SHA256
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6
-
SHA512
6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2
-
SSDEEP
12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4
Malware Config
Extracted
quasar
1.4.0.0
Office04
youhackernetpaingodxd.duckdns.org:5557
blablashitspreading.ddns.net:5557
xEoEv3HHdyEIYwJRFM
-
encryption_key
w3WfcmWh1iXT9cxeKFEX
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/564-66-0x0000000007360000-0x00000000075CE000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Quasar payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1952-76-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1952-77-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1952-78-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1952-79-0x00000000004494BE-mapping.dmp family_quasar behavioral1/memory/1952-81-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar behavioral1/memory/1952-83-0x0000000000400000-0x000000000044E000-memory.dmp family_quasar -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Updater-File.exepid process 564 Updater-File.exe -
Loads dropped DLL 1 IoCs
Processes:
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exepid process 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Updater-File.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Driver.exe\"" Updater-File.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Updater-File.exedescription pid process target process PID 564 set thread context of 1952 564 Updater-File.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 684 1232 WerFault.exe 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeUpdater-File.exepid process 1704 powershell.exe 564 Updater-File.exe 564 Updater-File.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exeUpdater-File.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Token: SeDebugPrivilege 564 Updater-File.exe Token: SeDebugPrivilege 1704 powershell.exe Token: SeDebugPrivilege 1952 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1952 RegAsm.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exeUpdater-File.exedescription pid process target process PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 564 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe Updater-File.exe PID 1232 wrote to memory of 684 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe WerFault.exe PID 1232 wrote to memory of 684 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe WerFault.exe PID 1232 wrote to memory of 684 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe WerFault.exe PID 1232 wrote to memory of 684 1232 305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe WerFault.exe PID 564 wrote to memory of 1704 564 Updater-File.exe powershell.exe PID 564 wrote to memory of 1704 564 Updater-File.exe powershell.exe PID 564 wrote to memory of 1704 564 Updater-File.exe powershell.exe PID 564 wrote to memory of 1704 564 Updater-File.exe powershell.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 2016 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe PID 564 wrote to memory of 1952 564 Updater-File.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe"C:\Users\Admin\AppData\Local\Temp\305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Updater-File.exe"C:\Users\Admin\AppData\Roaming\Updater-File.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 14522⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Updater-File.exeFilesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b
-
C:\Users\Admin\AppData\Roaming\Updater-File.exeFilesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b
-
\Users\Admin\AppData\Roaming\Updater-File.exeFilesize
6KB
MD5be2c9d9f3e9206eb7d809157ea37d0ea
SHA179fc984efb6d9e58c21f7c5dee8de2fc44710f62
SHA256f07ca31e483745ac9fe74da53f939a797f3f8868717eb29f9f0d1286b89f6b79
SHA5122510583a2690be0c48614fa21d24c2919d6c4f704d897ed4bb5a523d0bbc3616bd2aba7a6b22120068a24aa756a9b6f37feeb2b8eb461b86c2eacde935478d4b
-
memory/564-66-0x0000000007360000-0x00000000075CE000-memory.dmpFilesize
2.4MB
-
memory/564-72-0x00000000051E0000-0x000000000523E000-memory.dmpFilesize
376KB
-
memory/564-62-0x0000000000F80000-0x0000000000F88000-memory.dmpFilesize
32KB
-
memory/564-59-0x0000000000000000-mapping.dmp
-
memory/684-64-0x0000000000000000-mapping.dmp
-
memory/1232-57-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1232-56-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/1232-65-0x0000000004565000-0x0000000004576000-memory.dmpFilesize
68KB
-
memory/1232-55-0x0000000006E00000-0x0000000006F56000-memory.dmpFilesize
1.3MB
-
memory/1232-54-0x0000000000860000-0x0000000000924000-memory.dmpFilesize
784KB
-
memory/1704-67-0x0000000000000000-mapping.dmp
-
memory/1704-70-0x000000006C660000-0x000000006CC0B000-memory.dmpFilesize
5.7MB
-
memory/1704-71-0x000000006C660000-0x000000006CC0B000-memory.dmpFilesize
5.7MB
-
memory/1704-69-0x000000006C660000-0x000000006CC0B000-memory.dmpFilesize
5.7MB
-
memory/1952-73-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1952-74-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1952-76-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1952-77-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1952-78-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1952-79-0x00000000004494BE-mapping.dmp
-
memory/1952-81-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1952-83-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB