Analysis

  • max time kernel
    479s
  • max time network
    486s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/08/2023, 11:05

General

  • Target

    Adobe Acrobat DC Setup.exe

  • Size

    3.6MB

  • MD5

    199601c1d96b5fcde87f700c4d2ed29b

  • SHA1

    1b59c81736b9ccebdb76bf826ab88dfd52f0dcd3

  • SHA256

    502571801e831f1f780c9b44bfc403f79f16de18f5b570d54816a5f9be0be22e

  • SHA512

    058ef1272748f339315d75f4ba474bb04231386e777ab60c8717a4fb8323eefcebd47798964efb34c11e1a3caf97480985889071635b440a94aa29ed32c94b2a

  • SSDEEP

    98304:cH/92AYawl1WPOl6NVLkJ0xECgR16/9NdBI:aljxYG9z

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.0

Botnet

PowerShell

C2

0.tcp.eu.ngrok.io:15101

Mutex

74e865e7-8aad-4e3d-9444-006353e7ca31

Attributes
  • encryption_key

    8A2A7B58F2803115FF796E733C7311493928333B

  • install_name

    launcher.exe

  • log_directory

    Windows Logs

  • reconnect_delay

    3000

  • startup_key

    Opera Launcher

  • subdirectory

    Opera Software

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC Setup.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /SC ONLOGON /tn PowerShell /tr %systemroot%\System32\WindowsPowerShell\v1.0\powershеll.exe
      2⤵
      • Creates scheduled task(s)
      PID:4692
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershеll.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3172
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4800
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4200
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml
      1⤵
      • Opens file in notepad (likely ransom note)
      PID:2236
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4680

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe

            Filesize

            3.2MB

            MD5

            5db8ff057e7b3926bad10ee2a2501377

            SHA1

            5531cd789c3c0906957ced945f3e72501eb7e2f5

            SHA256

            ecd4a99e2844c0fe336a820ce67effd8d93e13c45fe3bae5b943d6d95833fc20

            SHA512

            fbf5001d18595de04b25e7fc983980dcd5f19d1e72e68174a2ca237786dc0d3575e8e1a9c332dda3acae51715c3f6259ca88b883a8fbbef3d1eeb30273ce8982

          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe

            Filesize

            3.2MB

            MD5

            5db8ff057e7b3926bad10ee2a2501377

            SHA1

            5531cd789c3c0906957ced945f3e72501eb7e2f5

            SHA256

            ecd4a99e2844c0fe336a820ce67effd8d93e13c45fe3bae5b943d6d95833fc20

            SHA512

            fbf5001d18595de04b25e7fc983980dcd5f19d1e72e68174a2ca237786dc0d3575e8e1a9c332dda3acae51715c3f6259ca88b883a8fbbef3d1eeb30273ce8982

          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe

            Filesize

            3.2MB

            MD5

            5db8ff057e7b3926bad10ee2a2501377

            SHA1

            5531cd789c3c0906957ced945f3e72501eb7e2f5

            SHA256

            ecd4a99e2844c0fe336a820ce67effd8d93e13c45fe3bae5b943d6d95833fc20

            SHA512

            fbf5001d18595de04b25e7fc983980dcd5f19d1e72e68174a2ca237786dc0d3575e8e1a9c332dda3acae51715c3f6259ca88b883a8fbbef3d1eeb30273ce8982

          • memory/3168-117-0x00000000735D0000-0x0000000073CBE000-memory.dmp

            Filesize

            6.9MB

          • memory/3168-118-0x0000000000FC0000-0x0000000001364000-memory.dmp

            Filesize

            3.6MB

          • memory/3168-119-0x0000000005B90000-0x0000000005C2C000-memory.dmp

            Filesize

            624KB

          • memory/3168-127-0x00000000735D0000-0x0000000073CBE000-memory.dmp

            Filesize

            6.9MB

          • memory/3172-129-0x000000001B200000-0x000000001B210000-memory.dmp

            Filesize

            64KB

          • memory/3172-128-0x00007FFD3C6E0000-0x00007FFD3D0CC000-memory.dmp

            Filesize

            9.9MB

          • memory/3172-130-0x000000001B5B0000-0x000000001B600000-memory.dmp

            Filesize

            320KB

          • memory/3172-131-0x000000001B6C0000-0x000000001B772000-memory.dmp

            Filesize

            712KB

          • memory/3172-132-0x00007FFD3C6E0000-0x00007FFD3D0CC000-memory.dmp

            Filesize

            9.9MB

          • memory/3172-133-0x000000001B200000-0x000000001B210000-memory.dmp

            Filesize

            64KB

          • memory/3172-141-0x000000001C0B0000-0x000000001C5D6000-memory.dmp

            Filesize

            5.1MB

          • memory/3172-142-0x00007FFD3C6E0000-0x00007FFD3D0CC000-memory.dmp

            Filesize

            9.9MB

          • memory/3172-126-0x0000000000270000-0x00000000005A2000-memory.dmp

            Filesize

            3.2MB

          • memory/4680-145-0x00007FFD3BAA0000-0x00007FFD3C48C000-memory.dmp

            Filesize

            9.9MB

          • memory/4680-146-0x000000001B8D0000-0x000000001B8E0000-memory.dmp

            Filesize

            64KB

          • memory/4680-147-0x00007FFD3BAA0000-0x00007FFD3C48C000-memory.dmp

            Filesize

            9.9MB