Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 10:04

General

  • Target

    Booking0217pdf.exe

  • Size

    62KB

  • MD5

    073a7d0ba4619b63b59e3f3c055a52e5

  • SHA1

    e7e91c2f94f946627bfd4cae19a263e7d99861cc

  • SHA256

    cd1a3a3951014346894a253fa1a9dc05b221640be311dc679a83b4f91b1449f0

  • SHA512

    d1e359651d072d18c645b05e016c8407e2f9ca17693cfbd73a04bf7c163865df640ec7cb81ebfc79522cf2e84b22f3e5cb73be088ee4b200c3a5fe4185de3ebb

  • SSDEEP

    768:4e9QoE/ASU2kRpqoOkAdsA9kWFXXtwboYzAF+IFqoZlO1iG8IYiV/eXlPxWEaB:4eid5kRpqIsdFn0Hz2qoFI7VeVPxu

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

16th JULY

C2

198.98.54.161:6666

Mutex

QSR_MUTEX_Pl8uFsFQG2ggU9gBx9

Attributes
  • encryption_key

    3XivPs8YQVpfxU1EhGZE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    notes

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Local\Temp\i.exe
      "C:\Users\Admin\AppData\Local\Temp\i.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Users\Admin\AppData\Local\Temp\m.exe
        "C:\Users\Admin\AppData\Local\Temp\m.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Users\Admin\AppData\Local\Temp\n.exe
          "C:\Users\Admin\AppData\Local\Temp\n.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            5⤵
            • Drops file in Windows directory
            PID:1604
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1004
              6⤵
              • Program crash
              PID:3860
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3216
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        3⤵
        • Drops file in Windows directory
        PID:4828
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1004
          4⤵
          • Program crash
          PID:1556
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2672
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    PID:3680
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4828 -ip 4828
    1⤵
      PID:3208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1604 -ip 1604
      1⤵
        PID:3416

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\i.exe

              Filesize

              62KB

              MD5

              ee07551af1ff71c8bf41081af118e533

              SHA1

              5d939457cf3cdde73b8f5d9208c19016ec6dc667

              SHA256

              2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

              SHA512

              df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

            • C:\Users\Admin\AppData\Local\Temp\i.exe

              Filesize

              62KB

              MD5

              ee07551af1ff71c8bf41081af118e533

              SHA1

              5d939457cf3cdde73b8f5d9208c19016ec6dc667

              SHA256

              2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

              SHA512

              df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

            • C:\Users\Admin\AppData\Local\Temp\i.exe

              Filesize

              62KB

              MD5

              ee07551af1ff71c8bf41081af118e533

              SHA1

              5d939457cf3cdde73b8f5d9208c19016ec6dc667

              SHA256

              2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

              SHA512

              df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

            • C:\Users\Admin\AppData\Local\Temp\m.exe

              Filesize

              35KB

              MD5

              ef2674a7a181ea242fa1d2ce7e1e4c8b

              SHA1

              04899dacbf89ba23aab59537f75415b6bb21c500

              SHA256

              51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

              SHA512

              a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

            • C:\Users\Admin\AppData\Local\Temp\m.exe

              Filesize

              35KB

              MD5

              ef2674a7a181ea242fa1d2ce7e1e4c8b

              SHA1

              04899dacbf89ba23aab59537f75415b6bb21c500

              SHA256

              51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

              SHA512

              a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

            • C:\Users\Admin\AppData\Local\Temp\m.exe

              Filesize

              35KB

              MD5

              ef2674a7a181ea242fa1d2ce7e1e4c8b

              SHA1

              04899dacbf89ba23aab59537f75415b6bb21c500

              SHA256

              51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

              SHA512

              a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

            • C:\Users\Admin\AppData\Local\Temp\n.exe

              Filesize

              25KB

              MD5

              1737530086de9cfe1ac2f0cdf726b5ae

              SHA1

              2aa91ea20f653f170aa53ac7d996674a41b8d241

              SHA256

              7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

              SHA512

              0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

            • C:\Users\Admin\AppData\Local\Temp\n.exe

              Filesize

              25KB

              MD5

              1737530086de9cfe1ac2f0cdf726b5ae

              SHA1

              2aa91ea20f653f170aa53ac7d996674a41b8d241

              SHA256

              7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

              SHA512

              0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

            • C:\Users\Admin\AppData\Local\Temp\n.exe

              Filesize

              25KB

              MD5

              1737530086de9cfe1ac2f0cdf726b5ae

              SHA1

              2aa91ea20f653f170aa53ac7d996674a41b8d241

              SHA256

              7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

              SHA512

              0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

            • C:\Users\Admin\AppData\Local\Temp\wsuFC13.tmp

              Filesize

              14KB

              MD5

              c01eaa0bdcd7c30a42bbb35a9acbf574

              SHA1

              0aee3e1b873e41d040f1991819d0027b6cc68f54

              SHA256

              32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

              SHA512

              d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7

            • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat

              Filesize

              29KB

              MD5

              6d308191115b992f40ba6b43df23ed26

              SHA1

              0b8aaa42ef60d022cbd301d32567bdbc7172340c

              SHA256

              7980a436c8ba91e94ca0992826ca72bcdab1b61223cd1772546f9d929abb78dc

              SHA512

              f5b081a4e61e7706c426c9e4c8fe29a165f1cd51128f90b07f9f5eab6aa00b15ed776cefb80004919fd66dc36997b586b17533d823d73080b5bfc8cf1430758e

            • memory/212-2335-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

              Filesize

              64KB

            • memory/212-3440-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/212-3420-0x0000000005410000-0x0000000005420000-memory.dmp

              Filesize

              64KB

            • memory/212-3421-0x0000000007430000-0x0000000007431000-memory.dmp

              Filesize

              4KB

            • memory/212-3118-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/212-2334-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/460-4367-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

              Filesize

              64KB

            • memory/460-3436-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/460-3435-0x0000000000070000-0x000000000007C000-memory.dmp

              Filesize

              48KB

            • memory/460-3441-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

              Filesize

              64KB

            • memory/460-4085-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/460-4557-0x0000000006890000-0x0000000006891000-memory.dmp

              Filesize

              4KB

            • memory/460-4562-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/1604-4561-0x0000000000400000-0x0000000000418000-memory.dmp

              Filesize

              96KB

            • memory/1604-4563-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/1604-4564-0x0000000005320000-0x0000000005330000-memory.dmp

              Filesize

              64KB

            • memory/1604-4565-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/1616-174-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-150-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-186-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-188-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-190-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-192-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-194-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-196-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-198-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-200-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-202-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-678-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/1616-879-0x0000000005A20000-0x0000000005A30000-memory.dmp

              Filesize

              64KB

            • memory/1616-1218-0x00000000078D0000-0x00000000078D1000-memory.dmp

              Filesize

              4KB

            • memory/1616-182-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-180-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-178-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-134-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/1616-135-0x0000000005EB0000-0x0000000006454000-memory.dmp

              Filesize

              5.6MB

            • memory/1616-136-0x0000000005850000-0x00000000058E2000-memory.dmp

              Filesize

              584KB

            • memory/1616-137-0x0000000005A20000-0x0000000005A30000-memory.dmp

              Filesize

              64KB

            • memory/1616-1237-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/1616-138-0x0000000005810000-0x000000000581A000-memory.dmp

              Filesize

              40KB

            • memory/1616-139-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-140-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-142-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-144-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-146-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-148-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-184-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-176-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-133-0x0000000000E10000-0x0000000000E24000-memory.dmp

              Filesize

              80KB

            • memory/1616-172-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-170-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-168-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-152-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-154-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-156-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-158-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-160-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-162-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-164-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/1616-166-0x0000000008200000-0x00000000082CB000-memory.dmp

              Filesize

              812KB

            • memory/2128-1238-0x0000000005AF0000-0x0000000005B00000-memory.dmp

              Filesize

              64KB

            • memory/2128-1233-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/2128-1232-0x0000000000FC0000-0x0000000000FD4000-memory.dmp

              Filesize

              80KB

            • memory/2128-2337-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/2128-2321-0x0000000006D30000-0x0000000006D31000-memory.dmp

              Filesize

              4KB

            • memory/2128-2118-0x0000000005AF0000-0x0000000005B00000-memory.dmp

              Filesize

              64KB

            • memory/2128-1780-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/2672-1235-0x0000000000400000-0x0000000000442000-memory.dmp

              Filesize

              264KB

            • memory/2672-1236-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/2672-1986-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/2672-1240-0x0000000005580000-0x00000000055E6000-memory.dmp

              Filesize

              408KB

            • memory/2672-1239-0x0000000005500000-0x0000000005510000-memory.dmp

              Filesize

              64KB

            • memory/2672-1803-0x0000000006990000-0x00000000069E0000-memory.dmp

              Filesize

              320KB

            • memory/3216-3438-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3216-3444-0x0000000006E50000-0x0000000006E8C000-memory.dmp

              Filesize

              240KB

            • memory/3216-3443-0x0000000006A10000-0x0000000006A22000-memory.dmp

              Filesize

              72KB

            • memory/3216-3442-0x0000000005920000-0x0000000005930000-memory.dmp

              Filesize

              64KB

            • memory/3216-4369-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/3216-3439-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/3216-4556-0x0000000005920000-0x0000000005930000-memory.dmp

              Filesize

              64KB

            • memory/4828-2342-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/4828-2338-0x0000000075300000-0x0000000075AB0000-memory.dmp

              Filesize

              7.7MB

            • memory/4828-2339-0x0000000000400000-0x0000000000418000-memory.dmp

              Filesize

              96KB

            • memory/4828-2340-0x00000000054F0000-0x000000000558C000-memory.dmp

              Filesize

              624KB

            • memory/4828-2341-0x0000000005680000-0x0000000005690000-memory.dmp

              Filesize

              64KB