Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    810s
  • max time network
    811s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2023 14:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    d5745aeed95df53334f3e3de9808b874

  • SHA1

    88877da94ce9c4121d5f5eb3fa9edb9fdf3a80ce

  • SHA256

    8cb80c88fea397c4b823bbe69891809fefb8fe98224a1552ac0cced93ed3437c

  • SHA512

    fe9512143d7020dadb5968025e3198d11dcebe66a0407c79ba27dc09a7459247c7265988a102749bed44c6b79e4b797a28268cbe2da03a58e47d2b19224ad413

  • SSDEEP

    49152:0v/t62XlaSFNWPjljiFa2RoUYI+ZyP+vEzTHHB72eh2NT:0vV62XlaSFNWPjljiFXRoUYI+Zi

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

181.215.176.73:59955

Mutex

efc7c4e1-67b9-4193-a637-9063d2f6052c

Attributes
  • encryption_key

    01A024E271E79DC5F555EC503C0E2AB6090246F2

  • install_name

    repl.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    replstart

  • subdirectory

    repl

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "replstart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\repl\repl.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:3252
    • C:\Users\Admin\AppData\Roaming\repl\repl.exe
      "C:\Users\Admin\AppData\Roaming\repl\repl.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "replstart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\repl\repl.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:3800
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\repl\repl.exe
    Filesize

    3.1MB

    MD5

    d5745aeed95df53334f3e3de9808b874

    SHA1

    88877da94ce9c4121d5f5eb3fa9edb9fdf3a80ce

    SHA256

    8cb80c88fea397c4b823bbe69891809fefb8fe98224a1552ac0cced93ed3437c

    SHA512

    fe9512143d7020dadb5968025e3198d11dcebe66a0407c79ba27dc09a7459247c7265988a102749bed44c6b79e4b797a28268cbe2da03a58e47d2b19224ad413

    Download Submit
  • C:\Users\Admin\AppData\Roaming\repl\repl.exe
    Filesize

    3.1MB

    MD5

    d5745aeed95df53334f3e3de9808b874

    SHA1

    88877da94ce9c4121d5f5eb3fa9edb9fdf3a80ce

    SHA256

    8cb80c88fea397c4b823bbe69891809fefb8fe98224a1552ac0cced93ed3437c

    SHA512

    fe9512143d7020dadb5968025e3198d11dcebe66a0407c79ba27dc09a7459247c7265988a102749bed44c6b79e4b797a28268cbe2da03a58e47d2b19224ad413

    Download Submit
  • memory/2004-158-0x000000001BE70000-0x000000001BE82000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2004-159-0x000000001BF30000-0x000000001BF6C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/2004-141-0x000000001B3A0000-0x000000001B3B0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2004-142-0x000000001BEA0000-0x000000001BEF0000-memory.dmp
    Filesize

    320KB

    Download
  • memory/2004-143-0x000000001BFB0000-0x000000001C062000-memory.dmp
    Filesize

    712KB

    Download
  • memory/2004-144-0x000000001B3A0000-0x000000001B3B0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2096-147-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-146-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-152-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-151-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-153-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-154-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-155-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-156-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-157-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2096-145-0x0000017A49950000-0x0000017A49951000-memory.dmp
    Filesize

    4KB

    Download
  • memory/5016-133-0x00000000000D0000-0x00000000003EA000-memory.dmp
    Filesize

    3.1MB

    Download
  • memory/5016-134-0x000000001B130000-0x000000001B140000-memory.dmp
    Filesize

    64KB

    Download