Analysis
-
max time kernel
98s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2023 13:32
Behavioral task
behavioral1
Sample
AccountRipper.exe
Resource
win7-20230220-en
General
-
Target
AccountRipper.exe
-
Size
3.2MB
-
MD5
06cbc080be08dda4bfd5068eeb59c6b0
-
SHA1
1bbda9c31d945429b53dd4784f0bf835e5c551df
-
SHA256
e9b48dffda40e2f2f6172e36d5646e6779a4bb4a0692083f8db1408206b6636e
-
SHA512
ee64e688544aaf5d5a444f5f0f3acabc6ac703ac49f4bf7858ae144b8f3e63348186e226ad7e8bb18b07fc0401f841e092588f2ef5602bb8d5d29179591f50a8
-
SSDEEP
49152:6vAt62XlaSFNWPjljiFa2RoUYI0X0+bRSLoGdtTHHB72eh2NT:6vs62XlaSFNWPjljiFXRoUYI0X0T
Malware Config
Extracted
quasar
1.4.1
Proton
212.154.101.132:3000
1b3adac2-334a-4914-b42a-429f32ec011f
-
encryption_key
8738101E98DC472C5F4C9FE5E109DEF1CA883172
-
install_name
Method.exe
-
log_directory
Logs
-
reconnect_delay
2
-
startup_key
Java
-
subdirectory
Proton
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4968-133-0x00000000001E0000-0x0000000000520000-memory.dmp family_quasar C:\Windows\System32\Proton\Method.exe family_quasar C:\Windows\system32\Proton\Method.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Method.exepid process 4008 Method.exe -
Drops file in System32 directory 4 IoCs
Processes:
AccountRipper.exeMethod.exedescription ioc process File created C:\Windows\system32\Proton\Method.exe AccountRipper.exe File opened for modification C:\Windows\system32\Proton\Method.exe AccountRipper.exe File opened for modification C:\Windows\system32\Proton AccountRipper.exe File opened for modification C:\Windows\system32\Proton Method.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1596 schtasks.exe 3584 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
AccountRipper.exeMethod.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4968 AccountRipper.exe Token: SeDebugPrivilege 4008 Method.exe Token: SeDebugPrivilege 4164 taskmgr.exe Token: SeSystemProfilePrivilege 4164 taskmgr.exe Token: SeCreateGlobalPrivilege 4164 taskmgr.exe Token: 33 4164 taskmgr.exe Token: SeIncBasePriorityPrivilege 4164 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Method.exetaskmgr.exepid process 4008 Method.exe 4008 Method.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Method.exetaskmgr.exepid process 4008 Method.exe 4008 Method.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe 4164 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Method.exepid process 4008 Method.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
AccountRipper.exeMethod.exedescription pid process target process PID 4968 wrote to memory of 1596 4968 AccountRipper.exe schtasks.exe PID 4968 wrote to memory of 1596 4968 AccountRipper.exe schtasks.exe PID 4968 wrote to memory of 4008 4968 AccountRipper.exe Method.exe PID 4968 wrote to memory of 4008 4968 AccountRipper.exe Method.exe PID 4008 wrote to memory of 3584 4008 Method.exe schtasks.exe PID 4008 wrote to memory of 3584 4008 Method.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AccountRipper.exe"C:\Users\Admin\AppData\Local\Temp\AccountRipper.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java" /sc ONLOGON /tr "C:\Windows\system32\Proton\Method.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\Proton\Method.exe"C:\Windows\system32\Proton\Method.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java" /sc ONLOGON /tr "C:\Windows\system32\Proton\Method.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\Proton\Method.exeFilesize
3.2MB
MD506cbc080be08dda4bfd5068eeb59c6b0
SHA11bbda9c31d945429b53dd4784f0bf835e5c551df
SHA256e9b48dffda40e2f2f6172e36d5646e6779a4bb4a0692083f8db1408206b6636e
SHA512ee64e688544aaf5d5a444f5f0f3acabc6ac703ac49f4bf7858ae144b8f3e63348186e226ad7e8bb18b07fc0401f841e092588f2ef5602bb8d5d29179591f50a8
-
C:\Windows\system32\Proton\Method.exeFilesize
3.2MB
MD506cbc080be08dda4bfd5068eeb59c6b0
SHA11bbda9c31d945429b53dd4784f0bf835e5c551df
SHA256e9b48dffda40e2f2f6172e36d5646e6779a4bb4a0692083f8db1408206b6636e
SHA512ee64e688544aaf5d5a444f5f0f3acabc6ac703ac49f4bf7858ae144b8f3e63348186e226ad7e8bb18b07fc0401f841e092588f2ef5602bb8d5d29179591f50a8
-
memory/4008-145-0x000000001BAE0000-0x000000001BAF0000-memory.dmpFilesize
64KB
-
memory/4008-159-0x000000001D0E0000-0x000000001D608000-memory.dmpFilesize
5.2MB
-
memory/4008-140-0x000000001BAE0000-0x000000001BAF0000-memory.dmpFilesize
64KB
-
memory/4008-141-0x0000000002DD0000-0x0000000002E20000-memory.dmpFilesize
320KB
-
memory/4008-142-0x000000001C1B0000-0x000000001C262000-memory.dmpFilesize
712KB
-
memory/4008-143-0x000000001B950000-0x000000001B962000-memory.dmpFilesize
72KB
-
memory/4008-144-0x000000001C0F0000-0x000000001C12C000-memory.dmpFilesize
240KB
-
memory/4164-146-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-147-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-148-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-152-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-154-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-153-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-155-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-156-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-158-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4164-157-0x000001B9AA890000-0x000001B9AA891000-memory.dmpFilesize
4KB
-
memory/4968-133-0x00000000001E0000-0x0000000000520000-memory.dmpFilesize
3.2MB
-
memory/4968-134-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB