Analysis
-
max time kernel
82s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 13:24
Static task
static1
Behavioral task
behavioral1
Sample
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe
Resource
win10v2004-20230220-en
General
-
Target
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe
-
Size
2.9MB
-
MD5
68a23c2fc62bddad0a2c6cf36003577b
-
SHA1
67a19bf734520933adfa28afc017c3af1d6a3d5b
-
SHA256
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7
-
SHA512
0386671ee83c0825f80a0c95b4e21eb23054878546aff5d8ef63a3bcc6a32c53a61397009aee8e8c5fc171b1ed0e9b69a31111eb1b860e1ff67264fcac806cef
-
SSDEEP
24576:plubLwtFDS7FYNYD7264xnRhc/LSXxH227hqRCeFcOziFJLUfdKTgWA22222222:gZ7h4xnRhcGXxHxOqdq1pup
Malware Config
Extracted
quasar
1.3.0.0
SUCCESS
41.185.97.216:4782
MUTEX_QAxMFzrXWG2cbIHPGK
-
encryption_key
4DwUV8AnxPgmXSMeThKb
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
cmd
-
subdirectory
SubDir
Signatures
-
Processes:
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 32 ip-api.com 69 ip-api.com -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2936-163-0x0000000000400000-0x000000000045E000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Client.exe7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation Client.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe -
Executes dropped EXE 2 IoCs
Processes:
Client.exeClient.exepid process 3232 Client.exe 3464 Client.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exeClient.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Omjvs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Saizfrsak\\Omjvs.exe\"" 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Omjvs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Saizfrsak\\Omjvs.exe\"" Client.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 32 ip-api.com 69 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exeClient.exedescription pid process target process PID 1264 set thread context of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 3232 set thread context of 3464 3232 Client.exe Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4668 schtasks.exe 1792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1320 powershell.exe 1320 powershell.exe 3656 powershell.exe 3656 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exe7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exepowershell.exeClient.exeClient.exedescription pid process Token: SeDebugPrivilege 1320 powershell.exe Token: SeDebugPrivilege 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe Token: SeDebugPrivilege 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe Token: SeDebugPrivilege 3656 powershell.exe Token: SeDebugPrivilege 3232 Client.exe Token: SeDebugPrivilege 3464 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 3464 Client.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exeClient.exeClient.exedescription pid process target process PID 1264 wrote to memory of 1320 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe powershell.exe PID 1264 wrote to memory of 1320 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe powershell.exe PID 1264 wrote to memory of 1320 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe powershell.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 1264 wrote to memory of 2936 1264 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe PID 2936 wrote to memory of 4668 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe schtasks.exe PID 2936 wrote to memory of 4668 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe schtasks.exe PID 2936 wrote to memory of 4668 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe schtasks.exe PID 2936 wrote to memory of 3232 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe Client.exe PID 2936 wrote to memory of 3232 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe Client.exe PID 2936 wrote to memory of 3232 2936 7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe Client.exe PID 3232 wrote to memory of 3656 3232 Client.exe powershell.exe PID 3232 wrote to memory of 3656 3232 Client.exe powershell.exe PID 3232 wrote to memory of 3656 3232 Client.exe powershell.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3232 wrote to memory of 3464 3232 Client.exe Client.exe PID 3464 wrote to memory of 1792 3464 Client.exe schtasks.exe PID 3464 wrote to memory of 1792 3464 Client.exe schtasks.exe PID 3464 wrote to memory of 1792 3464 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe"C:\Users\Admin\AppData\Local\Temp\7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe"1⤵
- Quasar RAT
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exeC:\Users\Admin\AppData\Local\Temp\7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "cmd" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4668 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3656 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeC:\Users\Admin\AppData\Roaming\SubDir\Client.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "cmd" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:1792
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7.exe.logFilesize
1KB
MD57e88081fcf716d85992bb3af3d9b6454
SHA12153780fbc71061b0102a7a7b665349e1013e250
SHA2565ffb4a3ea94a6a53c4f88e2191c6fec5fd8a7336e367aa113fe8c12631e0c4d2
SHA512ec606e14367ae221c04f213a61a6f797034495121198e4788e3afa4aa8db67bf59c5c5210a56afae5557158e8923b013b371b84c7d64303618c5b4c57a2224f7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD59d23fd09b5ed3e198eb27a399d6ab793
SHA1529452ad771d734994bc3a766a3d27df05945551
SHA256aa2b7df9bb59c310000392e7902801b31734f45dc22e92f9cd4492ff1e79aff7
SHA512a184656aad72ffb2f4221761b435a4adfe844713a129f5500228888838a53976aaaeeae6c6ea3d4574a5f8d7410dc4a3fd4056164cabdf15e5f18c587a5f0eba
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mcyeq2r0.xil.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Saizfrsak\Omjvs.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.9MB
MD568a23c2fc62bddad0a2c6cf36003577b
SHA167a19bf734520933adfa28afc017c3af1d6a3d5b
SHA2567a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7
SHA5120386671ee83c0825f80a0c95b4e21eb23054878546aff5d8ef63a3bcc6a32c53a61397009aee8e8c5fc171b1ed0e9b69a31111eb1b860e1ff67264fcac806cef
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.9MB
MD568a23c2fc62bddad0a2c6cf36003577b
SHA167a19bf734520933adfa28afc017c3af1d6a3d5b
SHA2567a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7
SHA5120386671ee83c0825f80a0c95b4e21eb23054878546aff5d8ef63a3bcc6a32c53a61397009aee8e8c5fc171b1ed0e9b69a31111eb1b860e1ff67264fcac806cef
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeFilesize
2.9MB
MD568a23c2fc62bddad0a2c6cf36003577b
SHA167a19bf734520933adfa28afc017c3af1d6a3d5b
SHA2567a6db8aecc2376ec7dfc50085757841523fb69135e364b70c7319bf7a39209d7
SHA5120386671ee83c0825f80a0c95b4e21eb23054878546aff5d8ef63a3bcc6a32c53a61397009aee8e8c5fc171b1ed0e9b69a31111eb1b860e1ff67264fcac806cef
-
memory/1264-155-0x00000000033D0000-0x00000000033E0000-memory.dmpFilesize
64KB
-
memory/1264-133-0x0000000000CD0000-0x0000000000FBA000-memory.dmpFilesize
2.9MB
-
memory/1264-135-0x0000000005CE0000-0x0000000005D02000-memory.dmpFilesize
136KB
-
memory/1264-134-0x00000000033D0000-0x00000000033E0000-memory.dmpFilesize
64KB
-
memory/1320-151-0x0000000005F30000-0x0000000005F4E000-memory.dmpFilesize
120KB
-
memory/1320-150-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1320-156-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1320-157-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1320-158-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1320-136-0x0000000002940000-0x0000000002976000-memory.dmpFilesize
216KB
-
memory/1320-153-0x0000000006430000-0x000000000644A000-memory.dmpFilesize
104KB
-
memory/1320-154-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1320-137-0x0000000005110000-0x0000000005738000-memory.dmpFilesize
6.2MB
-
memory/1320-138-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/1320-139-0x00000000058A0000-0x0000000005906000-memory.dmpFilesize
408KB
-
memory/1320-149-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/1320-152-0x0000000007570000-0x0000000007BEA000-memory.dmpFilesize
6.5MB
-
memory/2936-166-0x0000000005980000-0x0000000005F24000-memory.dmpFilesize
5.6MB
-
memory/2936-167-0x0000000005470000-0x0000000005502000-memory.dmpFilesize
584KB
-
memory/2936-170-0x0000000006810000-0x000000000684C000-memory.dmpFilesize
240KB
-
memory/2936-169-0x00000000062B0000-0x00000000062C2000-memory.dmpFilesize
72KB
-
memory/2936-168-0x0000000005520000-0x0000000005530000-memory.dmpFilesize
64KB
-
memory/2936-163-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/3232-190-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/3232-175-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/3464-199-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/3464-201-0x0000000006F20000-0x0000000006F2A000-memory.dmpFilesize
40KB
-
memory/3464-202-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/3656-189-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB
-
memory/3656-191-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB
-
memory/3656-192-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB
-
memory/3656-188-0x0000000005190000-0x00000000051A0000-memory.dmpFilesize
64KB