Analysis

  • max time kernel
    133s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2023, 10:46

General

  • Target

    Booking0217pdf.exe

  • Size

    62KB

  • MD5

    073a7d0ba4619b63b59e3f3c055a52e5

  • SHA1

    e7e91c2f94f946627bfd4cae19a263e7d99861cc

  • SHA256

    cd1a3a3951014346894a253fa1a9dc05b221640be311dc679a83b4f91b1449f0

  • SHA512

    d1e359651d072d18c645b05e016c8407e2f9ca17693cfbd73a04bf7c163865df640ec7cb81ebfc79522cf2e84b22f3e5cb73be088ee4b200c3a5fe4185de3ebb

  • SSDEEP

    768:4e9QoE/ASU2kRpqoOkAdsA9kWFXXtwboYzAF+IFqoZlO1iG8IYiV/eXlPxWEaB:4eid5kRpqIsdFn0Hz2qoFI7VeVPxu

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

16th JULY

C2

198.98.54.161:6666

Mutex

QSR_MUTEX_Pl8uFsFQG2ggU9gBx9

Attributes
  • encryption_key

    3XivPs8YQVpfxU1EhGZE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    notes

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking0217pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Users\Admin\AppData\Local\Temp\i.exe
      "C:\Users\Admin\AppData\Local\Temp\i.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4612
      • C:\Users\Admin\AppData\Local\Temp\m.exe
        "C:\Users\Admin\AppData\Local\Temp\m.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Users\Admin\AppData\Local\Temp\n.exe
          "C:\Users\Admin\AppData\Local\Temp\n.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            5⤵
            • Drops file in Windows directory
            PID:2392
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 1004
              6⤵
              • Program crash
              PID:2400
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          4⤵
            PID:3904
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2560
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          3⤵
          • Drops file in Windows directory
          PID:2792
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 1004
            4⤵
            • Program crash
            PID:3480
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2792 -ip 2792
      1⤵
        PID:3484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2392 -ip 2392
        1⤵
          PID:4664

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\i.exe

                Filesize

                62KB

                MD5

                ee07551af1ff71c8bf41081af118e533

                SHA1

                5d939457cf3cdde73b8f5d9208c19016ec6dc667

                SHA256

                2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

                SHA512

                df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

              • C:\Users\Admin\AppData\Local\Temp\i.exe

                Filesize

                62KB

                MD5

                ee07551af1ff71c8bf41081af118e533

                SHA1

                5d939457cf3cdde73b8f5d9208c19016ec6dc667

                SHA256

                2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

                SHA512

                df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

              • C:\Users\Admin\AppData\Local\Temp\i.exe

                Filesize

                62KB

                MD5

                ee07551af1ff71c8bf41081af118e533

                SHA1

                5d939457cf3cdde73b8f5d9208c19016ec6dc667

                SHA256

                2d65ad95a0b21f9ed668d3bd5ec95e79e6b69d9defd07f86ee4813cd01ab6dd3

                SHA512

                df95760068b8d9aad9603f0f2ec0e70c9c0ccbdbc2b7aa3d0623d580b55abb1ce6642c031560ce38918b5c34d213127dac516347a911ab34f9037c053b1ca00c

              • C:\Users\Admin\AppData\Local\Temp\m.exe

                Filesize

                35KB

                MD5

                ef2674a7a181ea242fa1d2ce7e1e4c8b

                SHA1

                04899dacbf89ba23aab59537f75415b6bb21c500

                SHA256

                51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

                SHA512

                a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

              • C:\Users\Admin\AppData\Local\Temp\m.exe

                Filesize

                35KB

                MD5

                ef2674a7a181ea242fa1d2ce7e1e4c8b

                SHA1

                04899dacbf89ba23aab59537f75415b6bb21c500

                SHA256

                51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

                SHA512

                a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

              • C:\Users\Admin\AppData\Local\Temp\m.exe

                Filesize

                35KB

                MD5

                ef2674a7a181ea242fa1d2ce7e1e4c8b

                SHA1

                04899dacbf89ba23aab59537f75415b6bb21c500

                SHA256

                51c425b7dd5cb71e28f1957179756f0d85c14a0c3af8d95151d1a7a345cff99f

                SHA512

                a97145fb11c92b85b6c17bad90f66aa6d818cb520af352a02b4dc19ba8c7e6a13f8ed6950737c0234bb7520692b2515de2bf21421070d36a34376ef01754ebdb

              • C:\Users\Admin\AppData\Local\Temp\n.exe

                Filesize

                25KB

                MD5

                1737530086de9cfe1ac2f0cdf726b5ae

                SHA1

                2aa91ea20f653f170aa53ac7d996674a41b8d241

                SHA256

                7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

                SHA512

                0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

              • C:\Users\Admin\AppData\Local\Temp\n.exe

                Filesize

                25KB

                MD5

                1737530086de9cfe1ac2f0cdf726b5ae

                SHA1

                2aa91ea20f653f170aa53ac7d996674a41b8d241

                SHA256

                7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

                SHA512

                0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

              • C:\Users\Admin\AppData\Local\Temp\n.exe

                Filesize

                25KB

                MD5

                1737530086de9cfe1ac2f0cdf726b5ae

                SHA1

                2aa91ea20f653f170aa53ac7d996674a41b8d241

                SHA256

                7de8e5f576d2cf58a13f17e7b6e3d51f3529404b4f6e79952e3d832de935ae4c

                SHA512

                0be0d89209579379c62faafb467285da9b8ec46fb7a1281543badd50764f7e543acc600bcce1faf724ef88b60e0927ac66fa80d4637893f299f33f7e33ed1237

              • memory/844-1234-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/844-2312-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/844-1503-0x0000000006DD0000-0x0000000006E20000-memory.dmp

                Filesize

                320KB

              • memory/844-1238-0x00000000059A0000-0x0000000005A06000-memory.dmp

                Filesize

                408KB

              • memory/844-1235-0x0000000000400000-0x0000000000442000-memory.dmp

                Filesize

                264KB

              • memory/2036-4521-0x00000000067D0000-0x00000000067D1000-memory.dmp

                Filesize

                4KB

              • memory/2036-3433-0x0000000000A10000-0x0000000000A1C000-memory.dmp

                Filesize

                48KB

              • memory/2036-3438-0x0000000005490000-0x00000000054A0000-memory.dmp

                Filesize

                64KB

              • memory/2036-4527-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2036-3434-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2036-4368-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2392-4526-0x0000000000400000-0x0000000000418000-memory.dmp

                Filesize

                96KB

              • memory/2392-4530-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2392-4529-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

                Filesize

                64KB

              • memory/2392-4528-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2560-3441-0x0000000006120000-0x0000000006132000-memory.dmp

                Filesize

                72KB

              • memory/2560-4525-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2560-3442-0x0000000006560000-0x000000000659C000-memory.dmp

                Filesize

                240KB

              • memory/2560-3440-0x0000000005440000-0x0000000005450000-memory.dmp

                Filesize

                64KB

              • memory/2560-3436-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2560-3437-0x0000000000400000-0x000000000045E000-memory.dmp

                Filesize

                376KB

              • memory/2792-2339-0x0000000005240000-0x0000000005250000-memory.dmp

                Filesize

                64KB

              • memory/2792-2336-0x0000000000400000-0x0000000000418000-memory.dmp

                Filesize

                96KB

              • memory/2792-2340-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/2792-2338-0x0000000004FC0000-0x000000000505C000-memory.dmp

                Filesize

                624KB

              • memory/2792-2335-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/3676-137-0x00000000053F0000-0x0000000005400000-memory.dmp

                Filesize

                64KB

              • memory/3676-170-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-200-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-202-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-973-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/3676-1072-0x00000000053F0000-0x0000000005400000-memory.dmp

                Filesize

                64KB

              • memory/3676-1217-0x00000000068D0000-0x00000000068D1000-memory.dmp

                Filesize

                4KB

              • memory/3676-186-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-184-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-182-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-134-0x00000000009C0000-0x00000000009D4000-memory.dmp

                Filesize

                80KB

              • memory/3676-135-0x0000000005A00000-0x0000000005FA4000-memory.dmp

                Filesize

                5.6MB

              • memory/3676-180-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-136-0x0000000005450000-0x00000000054E2000-memory.dmp

                Filesize

                584KB

              • memory/3676-178-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-1237-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/3676-176-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-139-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-150-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-172-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-198-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-138-0x00000000053D0000-0x00000000053DA000-memory.dmp

                Filesize

                40KB

              • memory/3676-174-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-168-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-166-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-188-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-140-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-196-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-194-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-142-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-192-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-133-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/3676-190-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-144-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-146-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-148-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-164-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-162-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-160-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-158-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-156-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-154-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/3676-152-0x0000000007B60000-0x0000000007C2B000-memory.dmp

                Filesize

                812KB

              • memory/4016-2333-0x0000000000F20000-0x0000000000F30000-memory.dmp

                Filesize

                64KB

              • memory/4016-3439-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/4016-3419-0x00000000077A0000-0x00000000077A1000-memory.dmp

                Filesize

                4KB

              • memory/4016-3418-0x00000000057F0000-0x0000000005800000-memory.dmp

                Filesize

                64KB

              • memory/4016-2961-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/4016-2332-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/4612-2337-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/4612-2319-0x0000000006A10000-0x0000000006A11000-memory.dmp

                Filesize

                4KB

              • memory/4612-2314-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

                Filesize

                64KB

              • memory/4612-2139-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/4612-1236-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

                Filesize

                64KB

              • memory/4612-1231-0x00000000752C0000-0x0000000075A70000-memory.dmp

                Filesize

                7.7MB

              • memory/4612-1230-0x00000000001A0000-0x00000000001B4000-memory.dmp

                Filesize

                80KB