Analysis

  • max time kernel
    1766s
  • max time network
    1779s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2023, 11:08

General

  • Target

    Adobe Acrobat DC Setup.exe

  • Size

    3.6MB

  • MD5

    e5ba9440e3338884a7963995ca9132d7

  • SHA1

    aa177c582fff33279a5e9fd27104c43cbf8d8a70

  • SHA256

    1eac2dc913dd6753e4195898af82412511a503990e1d5b7a86fd5919f6feee82

  • SHA512

    54e3b044a9ae4583e89695e9c7ab1e6933ea38ff55473f32537b0a9adf6522a7fb433bc143224e0b6f79223692b474acbd1196fc2e2b361f1182062250a76bc7

  • SSDEEP

    98304:4ZeSO1fNPbR/5pGs4+Lrlkixl7u2J43gZxbCaly7yhR+pd2SwGJYdy8K+I:cIWJX8K

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.0

Botnet

Powershell

C2

0.tcp.eu.ngrok.io:16640

Mutex

039bf99d-a398-4525-a7b4-00d8916a2e80

Attributes
  • encryption_key

    8A2A7B58F2803115FF796E733C7311493928333B

  • install_name

    AppLaunch.exe

  • log_directory

    Windows Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    Windows Applications

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC Setup.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /SC ONLOGON /tn PowerShell /tr %systemroot%\System32\WindowsPowerShell\v1.0\powershеll.exe
      2⤵
      • Creates scheduled task(s)
      PID:3088
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershеll.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1408

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Windows Logs\2023-08-16

          Filesize

          304B

          MD5

          50defcfc4bbe2e8d0ceb51423e803119

          SHA1

          23ac63264c00e6f5d9de38c723476c5a4ec94899

          SHA256

          3233e42f48eda5768ad96e4b967d3b6f650afe748cf9d3e95d711bef462627a9

          SHA512

          34b6a15292027e1d94ede71dea898df6154bf7e3ed52b8b6dc01882ee376087e95b659cb21c57eeec4c94f657dd94918598628dc7cb37e33861bb382422e5087

        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe

          Filesize

          3.2MB

          MD5

          fdd63d8e4b7dd0c30b0db7e3eeecacf5

          SHA1

          459e5f66dbcba0c68055de45621bd0a1f02d9058

          SHA256

          4fb157d755b2747ee028d5b8e79b9a5a8ad76bcea6c0c0c4321b3c968b0995d3

          SHA512

          c8291cfb83564d7ff999713d16b2ccc627ec38a88f1aa9e04724c483f66ef14cc56a096ecc7321b213c68c56f2d910b49513948e61a84f390c105df46ee59650

        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe

          Filesize

          3.2MB

          MD5

          fdd63d8e4b7dd0c30b0db7e3eeecacf5

          SHA1

          459e5f66dbcba0c68055de45621bd0a1f02d9058

          SHA256

          4fb157d755b2747ee028d5b8e79b9a5a8ad76bcea6c0c0c4321b3c968b0995d3

          SHA512

          c8291cfb83564d7ff999713d16b2ccc627ec38a88f1aa9e04724c483f66ef14cc56a096ecc7321b213c68c56f2d910b49513948e61a84f390c105df46ee59650

        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershеll.exe

          Filesize

          3.2MB

          MD5

          fdd63d8e4b7dd0c30b0db7e3eeecacf5

          SHA1

          459e5f66dbcba0c68055de45621bd0a1f02d9058

          SHA256

          4fb157d755b2747ee028d5b8e79b9a5a8ad76bcea6c0c0c4321b3c968b0995d3

          SHA512

          c8291cfb83564d7ff999713d16b2ccc627ec38a88f1aa9e04724c483f66ef14cc56a096ecc7321b213c68c56f2d910b49513948e61a84f390c105df46ee59650

        • memory/1408-158-0x000000001B430000-0x000000001B442000-memory.dmp

          Filesize

          72KB

        • memory/1408-159-0x000000001C780000-0x000000001C7BC000-memory.dmp

          Filesize

          240KB

        • memory/1408-150-0x00000000003D0000-0x0000000000702000-memory.dmp

          Filesize

          3.2MB

        • memory/1408-151-0x00007FFF32DB0000-0x00007FFF33871000-memory.dmp

          Filesize

          10.8MB

        • memory/1408-152-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/1408-153-0x0000000002970000-0x00000000029C0000-memory.dmp

          Filesize

          320KB

        • memory/1408-154-0x000000001B940000-0x000000001B9F2000-memory.dmp

          Filesize

          712KB

        • memory/1408-174-0x000000001B880000-0x000000001B919000-memory.dmp

          Filesize

          612KB

        • memory/1408-170-0x000000001DB80000-0x000000001E0A8000-memory.dmp

          Filesize

          5.2MB

        • memory/1408-168-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/1408-160-0x000000001B880000-0x000000001B919000-memory.dmp

          Filesize

          612KB

        • memory/1408-161-0x00007FFF32DB0000-0x00007FFF33871000-memory.dmp

          Filesize

          10.8MB

        • memory/1408-162-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/1408-164-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/1408-165-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/1408-166-0x00000000029C0000-0x00000000029D0000-memory.dmp

          Filesize

          64KB

        • memory/3992-135-0x00000000052D0000-0x000000000536C000-memory.dmp

          Filesize

          624KB

        • memory/3992-133-0x0000000074520000-0x0000000074CD0000-memory.dmp

          Filesize

          7.7MB

        • memory/3992-157-0x0000000074520000-0x0000000074CD0000-memory.dmp

          Filesize

          7.7MB

        • memory/3992-134-0x00000000005C0000-0x0000000000964000-memory.dmp

          Filesize

          3.6MB