Analysis

  • max time kernel
    135s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-06-2023 11:29

General

  • Target

    file.exe

  • Size

    3.8MB

  • MD5

    4693d917d5573d64bfd2a27e46e04504

  • SHA1

    fb97fec5b335804929dc3c8fb7e69073467f4754

  • SHA256

    2d24effcdf6f620d368752b0bba8f2b96b01b82d95c36b6d5b34ddbe7740362d

  • SHA512

    05f08728f753b0c115f5e30163c08783d3e0dc68762d621bfd1887e8c41d746fba45f22fc10594f48a852222a432ca99bcfeadc2d83d316eb41c51c7f171749a

  • SSDEEP

    49152:k6fBW2t1NiKOBFAzHpe64btMTabv3/LQOlFIpfllgqSBZ7rQ0kV8e:k6

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

hostmeta.duckdns.org:3400

Mutex

PCoa0XHES5x7Cr7a01

Attributes
  • encryption_key

    cH5E0mLkGfudyeRokQBJ

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /release
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3188
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /release
        3⤵
        • Gathers network information
        PID:3436
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAyAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1832
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ipconfig /renew
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4668
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:2272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
        PID:4824
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1328

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      1KB

      MD5

      4280e36a29fa31c01e4d8b2ba726a0d8

      SHA1

      c485c2c9ce0a99747b18d899b71dfa9a64dabe32

      SHA256

      e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

      SHA512

      494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

      Filesize

      53KB

      MD5

      06ad34f9739c5159b4d92d702545bd49

      SHA1

      9152a0d4f153f3f40f7e606be75f81b582ee0c17

      SHA256

      474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

      SHA512

      c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      16KB

      MD5

      a99462049eb87294fb8fcb7fc0df1622

      SHA1

      f7d45096a04130f6ef74550db93f375a53d6b6eb

      SHA256

      4b2360b3f4f59ede4fe3d5f397d795763df0989d855d463f955702c4b5cddcbc

      SHA512

      b12ab0a970f8df582d3b8eea6b7265e6016d5c14ad22667c59edf1d406196126ee4c7e035a0c311e0e01c268c7a75a309bee23ebb79346e4cfe0678339a470cb

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0fnvzkxk.b2c.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/1328-204-0x0000000005720000-0x0000000005730000-memory.dmp

      Filesize

      64KB

    • memory/1328-202-0x0000000006B50000-0x0000000006B8C000-memory.dmp

      Filesize

      240KB

    • memory/1328-201-0x0000000006720000-0x0000000006732000-memory.dmp

      Filesize

      72KB

    • memory/1328-195-0x0000000005720000-0x0000000005730000-memory.dmp

      Filesize

      64KB

    • memory/1328-182-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/1832-161-0x00000000030B0000-0x00000000030C0000-memory.dmp

      Filesize

      64KB

    • memory/1832-140-0x0000000005760000-0x0000000005D88000-memory.dmp

      Filesize

      6.2MB

    • memory/1832-144-0x0000000005F40000-0x0000000005FA6000-memory.dmp

      Filesize

      408KB

    • memory/1832-142-0x00000000030B0000-0x00000000030C0000-memory.dmp

      Filesize

      64KB

    • memory/1832-154-0x00000000065A0000-0x00000000065BE000-memory.dmp

      Filesize

      120KB

    • memory/1832-155-0x00000000030B0000-0x00000000030C0000-memory.dmp

      Filesize

      64KB

    • memory/1832-156-0x0000000007E00000-0x000000000847A000-memory.dmp

      Filesize

      6.5MB

    • memory/1832-157-0x0000000006AA0000-0x0000000006ABA000-memory.dmp

      Filesize

      104KB

    • memory/1832-143-0x00000000030B0000-0x00000000030C0000-memory.dmp

      Filesize

      64KB

    • memory/1832-159-0x00000000030B0000-0x00000000030C0000-memory.dmp

      Filesize

      64KB

    • memory/1832-160-0x00000000030B0000-0x00000000030C0000-memory.dmp

      Filesize

      64KB

    • memory/1832-139-0x0000000002FB0000-0x0000000002FE6000-memory.dmp

      Filesize

      216KB

    • memory/1832-141-0x0000000005660000-0x00000000056C6000-memory.dmp

      Filesize

      408KB

    • memory/2196-158-0x0000000005510000-0x0000000005520000-memory.dmp

      Filesize

      64KB

    • memory/2196-137-0x0000000005510000-0x0000000005520000-memory.dmp

      Filesize

      64KB

    • memory/2196-134-0x0000000005900000-0x0000000005EA4000-memory.dmp

      Filesize

      5.6MB

    • memory/2196-133-0x0000000000650000-0x0000000000A2C000-memory.dmp

      Filesize

      3.9MB

    • memory/2196-135-0x00000000053F0000-0x0000000005482000-memory.dmp

      Filesize

      584KB

    • memory/2196-136-0x00000000053E0000-0x00000000053EA000-memory.dmp

      Filesize

      40KB

    • memory/2196-138-0x00000000082A0000-0x00000000082C2000-memory.dmp

      Filesize

      136KB

    • memory/4780-196-0x000000007FC70000-0x000000007FC80000-memory.dmp

      Filesize

      64KB

    • memory/4780-194-0x0000000007A50000-0x0000000007A5A000-memory.dmp

      Filesize

      40KB

    • memory/4780-168-0x0000000003090000-0x00000000030A0000-memory.dmp

      Filesize

      64KB

    • memory/4780-193-0x0000000006C30000-0x0000000006C4E000-memory.dmp

      Filesize

      120KB

    • memory/4780-197-0x0000000007C90000-0x0000000007D26000-memory.dmp

      Filesize

      600KB

    • memory/4780-198-0x0000000006520000-0x000000000652E000-memory.dmp

      Filesize

      56KB

    • memory/4780-199-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

      Filesize

      104KB

    • memory/4780-200-0x0000000007BD0000-0x0000000007BD8000-memory.dmp

      Filesize

      32KB

    • memory/4780-181-0x000000006F560000-0x000000006F5AC000-memory.dmp

      Filesize

      304KB

    • memory/4780-180-0x0000000006C60000-0x0000000006C92000-memory.dmp

      Filesize

      200KB

    • memory/4780-167-0x0000000003090000-0x00000000030A0000-memory.dmp

      Filesize

      64KB