Analysis

  • max time kernel
    34s
  • max time network
    38s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2023, 05:18

General

  • Target

    SkyClicker.exe

  • Size

    879KB

  • MD5

    8fd1d7bea1de60f132dc4103d48f80e9

  • SHA1

    d202c62c782c6352b2fd0592f2fb1ffc41ec1e99

  • SHA256

    63e121b2616865f3031d80563fac2dbfedab31ae1b44910cbc6aa42b1ddfcb28

  • SHA512

    99de0315cd72ea827e801c827ed492c4b656405143e5e33909711c598e38be7b8ac443b08063493bc9d5890d8529a802a650a3acea23b7b59ac34d14ed0d56cc

  • SSDEEP

    12288:OfMaHoBDU8vm1gJlZ753yWJtbYKh+px8XNoMPIhc:OfMaiU83NgWJJh+px8doJW

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Vasili

C2

7.tcp.ngrok.io:26659

Mutex

QSR_MUTEX_wD3LltN4UfhGLKcWXQ

Attributes
  • encryption_key

    S4LQWME0QBUBvcmHQtmO

  • install_name

    AutoClicker.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    AutoClicker

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 9 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SkyClicker.exe
    "C:\Users\Admin\AppData\Local\Temp\SkyClicker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe
      "C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:3060
    • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe
      "C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2704
      • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe
        "C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2284
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:1660

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe

          Filesize

          258KB

          MD5

          4cc67fd222248aef648e6fa803c918c4

          SHA1

          0e614d4b57fa433f39d1fca128e19b52aaf7de02

          SHA256

          c8e137290f940dc4ef1b1acb2a1745cf59d335681ef3d32e199bffad639fc0f3

          SHA512

          518d9f91a41fb10efc08bd02447982f11654c2f131e96527dbee8dabe0a6ff4123cf210ae20ddfaab54796d57f033be7c31afe2926e239ff0a0d218f43052fa5

        • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe

          Filesize

          258KB

          MD5

          4cc67fd222248aef648e6fa803c918c4

          SHA1

          0e614d4b57fa433f39d1fca128e19b52aaf7de02

          SHA256

          c8e137290f940dc4ef1b1acb2a1745cf59d335681ef3d32e199bffad639fc0f3

          SHA512

          518d9f91a41fb10efc08bd02447982f11654c2f131e96527dbee8dabe0a6ff4123cf210ae20ddfaab54796d57f033be7c31afe2926e239ff0a0d218f43052fa5

        • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • \Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • \Users\Admin\AppData\Roaming\SkyClickerUpdate.exe

          Filesize

          258KB

          MD5

          4cc67fd222248aef648e6fa803c918c4

          SHA1

          0e614d4b57fa433f39d1fca128e19b52aaf7de02

          SHA256

          c8e137290f940dc4ef1b1acb2a1745cf59d335681ef3d32e199bffad639fc0f3

          SHA512

          518d9f91a41fb10efc08bd02447982f11654c2f131e96527dbee8dabe0a6ff4123cf210ae20ddfaab54796d57f033be7c31afe2926e239ff0a0d218f43052fa5

        • \Users\Admin\AppData\Roaming\Skys AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • memory/2284-94-0x0000000004C80000-0x0000000004CC0000-memory.dmp

          Filesize

          256KB

        • memory/2284-93-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2284-88-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2284-90-0x0000000004C80000-0x0000000004CC0000-memory.dmp

          Filesize

          256KB

        • memory/2284-87-0x0000000000130000-0x00000000001D0000-memory.dmp

          Filesize

          640KB

        • memory/2304-72-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/2304-89-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2304-79-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2304-70-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/2304-69-0x0000000000D10000-0x0000000000DB0000-memory.dmp

          Filesize

          640KB

        • memory/3060-68-0x00000000008D0000-0x0000000000916000-memory.dmp

          Filesize

          280KB

        • memory/3060-86-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/3060-78-0x0000000000870000-0x0000000000871000-memory.dmp

          Filesize

          4KB

        • memory/3060-77-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB

        • memory/3060-75-0x00000000005C0000-0x00000000005CA000-memory.dmp

          Filesize

          40KB

        • memory/3060-74-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB

        • memory/3060-92-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB

        • memory/3060-73-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB

        • memory/3060-71-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/3060-95-0x00000000748B0000-0x0000000074F9E000-memory.dmp

          Filesize

          6.9MB

        • memory/3060-96-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

          Filesize

          256KB