Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 09:31

General

  • Target

    Booking0217pdf.exe

  • Size

    62KB

  • MD5

    073a7d0ba4619b63b59e3f3c055a52e5

  • SHA1

    e7e91c2f94f946627bfd4cae19a263e7d99861cc

  • SHA256

    cd1a3a3951014346894a253fa1a9dc05b221640be311dc679a83b4f91b1449f0

  • SHA512

    d1e359651d072d18c645b05e016c8407e2f9ca17693cfbd73a04bf7c163865df640ec7cb81ebfc79522cf2e84b22f3e5cb73be088ee4b200c3a5fe4185de3ebb

  • SSDEEP

    768:4e9QoE/ASU2kRpqoOkAdsA9kWFXXtwboYzAF+IFqoZlO1iG8IYiV/eXlPxWEaB:4eid5kRpqIsdFn0Hz2qoFI7VeVPxu

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

16th JULY

C2

198.98.54.161:6666

Mutex

QSR_MUTEX_Pl8uFsFQG2ggU9gBx9

Attributes
  • encryption_key

    3XivPs8YQVpfxU1EhGZE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    notes

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\i.exe
      "C:\Users\Admin\AppData\Local\Temp\i.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Users\Admin\AppData\Local\Temp\m.exe
        "C:\Users\Admin\AppData\Local\Temp\m.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Users\Admin\AppData\Local\Temp\n.exe
          "C:\Users\Admin\AppData\Local\Temp\n.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1144
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            5⤵
            • Drops file in Windows directory
            PID:4364
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1004
              6⤵
              • Program crash
              PID:1688
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          4⤵
            PID:1492
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            4⤵
              PID:4460
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:488
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            3⤵
            • Drops file in Windows directory
            PID:4200
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 1008
              4⤵
              • Program crash
              PID:4168
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4200 -ip 4200
        1⤵
          PID:4736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4364 -ip 4364
          1⤵
            PID:4028

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\i.exe

                  Filesize

                  62KB

                  MD5

                  ee07551af1ff71c8bf41081af118e533

                  SHA1

                  5d939457cf3cdde73b8f5d9208c19016ec6dc667

                  SHA256

                  2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

                  SHA512

                  df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

                • C:\Users\Admin\AppData\Local\Temp\i.exe

                  Filesize

                  62KB

                  MD5

                  ee07551af1ff71c8bf41081af118e533

                  SHA1

                  5d939457cf3cdde73b8f5d9208c19016ec6dc667

                  SHA256

                  2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

                  SHA512

                  df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

                • C:\Users\Admin\AppData\Local\Temp\i.exe

                  Filesize

                  62KB

                  MD5

                  ee07551af1ff71c8bf41081af118e533

                  SHA1

                  5d939457cf3cdde73b8f5d9208c19016ec6dc667

                  SHA256

                  2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

                  SHA512

                  df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

                • C:\Users\Admin\AppData\Local\Temp\m.exe

                  Filesize

                  35KB

                  MD5

                  ef2674a7a181ea242fa1d2ce7e1e4c8b

                  SHA1

                  04899dacbf89ba23aab59537f75415b6bb21c500

                  SHA256

                  51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

                  SHA512

                  a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

                • C:\Users\Admin\AppData\Local\Temp\m.exe

                  Filesize

                  35KB

                  MD5

                  ef2674a7a181ea242fa1d2ce7e1e4c8b

                  SHA1

                  04899dacbf89ba23aab59537f75415b6bb21c500

                  SHA256

                  51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

                  SHA512

                  a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

                • C:\Users\Admin\AppData\Local\Temp\m.exe

                  Filesize

                  35KB

                  MD5

                  ef2674a7a181ea242fa1d2ce7e1e4c8b

                  SHA1

                  04899dacbf89ba23aab59537f75415b6bb21c500

                  SHA256

                  51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

                  SHA512

                  a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

                • C:\Users\Admin\AppData\Local\Temp\n.exe

                  Filesize

                  25KB

                  MD5

                  1737530086de9cfe1ac2f0cdf726b5ae

                  SHA1

                  2aa91ea20f653f170aa53ac7d996674a41b8d241

                  SHA256

                  7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

                  SHA512

                  0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

                • C:\Users\Admin\AppData\Local\Temp\n.exe

                  Filesize

                  25KB

                  MD5

                  1737530086de9cfe1ac2f0cdf726b5ae

                  SHA1

                  2aa91ea20f653f170aa53ac7d996674a41b8d241

                  SHA256

                  7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

                  SHA512

                  0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

                • C:\Users\Admin\AppData\Local\Temp\n.exe

                  Filesize

                  25KB

                  MD5

                  1737530086de9cfe1ac2f0cdf726b5ae

                  SHA1

                  2aa91ea20f653f170aa53ac7d996674a41b8d241

                  SHA256

                  7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

                  SHA512

                  0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

                • memory/488-4530-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/488-3441-0x0000000005160000-0x0000000005170000-memory.dmp

                  Filesize

                  64KB

                • memory/488-3439-0x0000000000400000-0x000000000045E000-memory.dmp

                  Filesize

                  376KB

                • memory/488-4531-0x0000000005160000-0x0000000005170000-memory.dmp

                  Filesize

                  64KB

                • memory/488-3438-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/488-3476-0x00000000064C0000-0x00000000064FC000-memory.dmp

                  Filesize

                  240KB

                • memory/488-3446-0x0000000006080000-0x0000000006092000-memory.dmp

                  Filesize

                  72KB

                • memory/1144-3433-0x0000000000260000-0x000000000026C000-memory.dmp

                  Filesize

                  48KB

                • memory/1144-3434-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1144-4521-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1144-4522-0x0000000004D30000-0x0000000004D40000-memory.dmp

                  Filesize

                  64KB

                • memory/1144-4527-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1144-3436-0x0000000004D30000-0x0000000004D40000-memory.dmp

                  Filesize

                  64KB

                • memory/1144-4523-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

                  Filesize

                  4KB

                • memory/1552-3240-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1552-2336-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1552-2334-0x0000000000F50000-0x0000000000F60000-memory.dmp

                  Filesize

                  64KB

                • memory/1552-3419-0x00000000057B0000-0x00000000057C0000-memory.dmp

                  Filesize

                  64KB

                • memory/1552-3420-0x00000000077D0000-0x00000000077D1000-memory.dmp

                  Filesize

                  4KB

                • memory/1552-3440-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2588-2339-0x00000000053F0000-0x0000000005400000-memory.dmp

                  Filesize

                  64KB

                • memory/2588-2318-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2588-2202-0x00000000067B0000-0x0000000006800000-memory.dmp

                  Filesize

                  320KB

                • memory/2588-1239-0x0000000005400000-0x0000000005466000-memory.dmp

                  Filesize

                  408KB

                • memory/2588-1238-0x00000000053F0000-0x0000000005400000-memory.dmp

                  Filesize

                  64KB

                • memory/2588-1236-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2588-1234-0x0000000000400000-0x0000000000442000-memory.dmp

                  Filesize

                  264KB

                • memory/3064-1231-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3064-1232-0x00000000006B0000-0x00000000006C4000-memory.dmp

                  Filesize

                  80KB

                • memory/3064-2332-0x0000000005200000-0x0000000005210000-memory.dmp

                  Filesize

                  64KB

                • memory/3064-2337-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3064-2319-0x0000000007010000-0x0000000007011000-memory.dmp

                  Filesize

                  4KB

                • memory/3064-2204-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3064-1237-0x0000000005200000-0x0000000005210000-memory.dmp

                  Filesize

                  64KB

                • memory/3184-148-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-136-0x0000000005600000-0x0000000005692000-memory.dmp

                  Filesize

                  584KB

                • memory/3184-133-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3184-192-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-196-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-190-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-198-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-1235-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3184-188-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-186-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-184-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-1217-0x0000000006BC0000-0x0000000006BC1000-memory.dmp

                  Filesize

                  4KB

                • memory/3184-182-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-1146-0x00000000057D0000-0x00000000057E0000-memory.dmp

                  Filesize

                  64KB

                • memory/3184-180-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-178-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-176-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-134-0x0000000000D50000-0x0000000000D64000-memory.dmp

                  Filesize

                  80KB

                • memory/3184-1024-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3184-174-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-172-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-135-0x0000000005C90000-0x0000000006234000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3184-170-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-137-0x00000000057D0000-0x00000000057E0000-memory.dmp

                  Filesize

                  64KB

                • memory/3184-194-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-202-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-150-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-166-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-164-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-162-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-160-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-158-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-156-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-154-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-152-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-168-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-200-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-146-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-144-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-142-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-140-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-139-0x0000000006AC0000-0x0000000006B8B000-memory.dmp

                  Filesize

                  812KB

                • memory/3184-138-0x00000000056B0000-0x00000000056BA000-memory.dmp

                  Filesize

                  40KB

                • memory/4200-2340-0x0000000004FF0000-0x000000000508C000-memory.dmp

                  Filesize

                  624KB

                • memory/4200-2341-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4200-2338-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4200-2335-0x0000000000400000-0x0000000000418000-memory.dmp

                  Filesize

                  96KB

                • memory/4364-4528-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4364-4529-0x0000000000400000-0x0000000000418000-memory.dmp

                  Filesize

                  96KB

                • memory/4364-4532-0x0000000005400000-0x0000000005410000-memory.dmp

                  Filesize

                  64KB

                • memory/4364-4533-0x0000000074670000-0x0000000074E20000-memory.dmp

                  Filesize

                  7.7MB