Analysis

  • max time kernel
    35s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2023, 05:18

General

  • Target

    SkyClicker.exe

  • Size

    879KB

  • MD5

    8fd1d7bea1de60f132dc4103d48f80e9

  • SHA1

    d202c62c782c6352b2fd0592f2fb1ffc41ec1e99

  • SHA256

    63e121b2616865f3031d80563fac2dbfedab31ae1b44910cbc6aa42b1ddfcb28

  • SHA512

    99de0315cd72ea827e801c827ed492c4b656405143e5e33909711c598e38be7b8ac443b08063493bc9d5890d8529a802a650a3acea23b7b59ac34d14ed0d56cc

  • SSDEEP

    12288:OfMaHoBDU8vm1gJlZ753yWJtbYKh+px8XNoMPIhc:OfMaiU83NgWJJh+px8doJW

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Vasili

C2

7.tcp.ngrok.io:26659

Mutex

QSR_MUTEX_wD3LltN4UfhGLKcWXQ

Attributes
  • encryption_key

    S4LQWME0QBUBvcmHQtmO

  • install_name

    AutoClicker.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    AutoClicker

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SkyClicker.exe
    "C:\Users\Admin\AppData\Local\Temp\SkyClicker.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe
      "C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:756
    • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe
      "C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:5064
      • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe
        "C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:392
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:3276

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\AutoClicker\AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe

          Filesize

          258KB

          MD5

          4cc67fd222248aef648e6fa803c918c4

          SHA1

          0e614d4b57fa433f39d1fca128e19b52aaf7de02

          SHA256

          c8e137290f940dc4ef1b1acb2a1745cf59d335681ef3d32e199bffad639fc0f3

          SHA512

          518d9f91a41fb10efc08bd02447982f11654c2f131e96527dbee8dabe0a6ff4123cf210ae20ddfaab54796d57f033be7c31afe2926e239ff0a0d218f43052fa5

        • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe

          Filesize

          258KB

          MD5

          4cc67fd222248aef648e6fa803c918c4

          SHA1

          0e614d4b57fa433f39d1fca128e19b52aaf7de02

          SHA256

          c8e137290f940dc4ef1b1acb2a1745cf59d335681ef3d32e199bffad639fc0f3

          SHA512

          518d9f91a41fb10efc08bd02447982f11654c2f131e96527dbee8dabe0a6ff4123cf210ae20ddfaab54796d57f033be7c31afe2926e239ff0a0d218f43052fa5

        • C:\Users\Admin\AppData\Roaming\SkyClickerUpdate.exe

          Filesize

          258KB

          MD5

          4cc67fd222248aef648e6fa803c918c4

          SHA1

          0e614d4b57fa433f39d1fca128e19b52aaf7de02

          SHA256

          c8e137290f940dc4ef1b1acb2a1745cf59d335681ef3d32e199bffad639fc0f3

          SHA512

          518d9f91a41fb10efc08bd02447982f11654c2f131e96527dbee8dabe0a6ff4123cf210ae20ddfaab54796d57f033be7c31afe2926e239ff0a0d218f43052fa5

        • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • C:\Users\Admin\AppData\Roaming\Skys AutoClicker.exe

          Filesize

          611KB

          MD5

          404ff5f5505d295755a32bcb659f822c

          SHA1

          cec19696a9f6b0b49fe7486a13a832306657a26d

          SHA256

          c60bb9619232051d996595dfc8919562b5814a5f1c3ebe06022d6c1aa21d053d

          SHA512

          d37de98166385eefeb064df6bbfa7457c8ebd4ae19b360cd897042a0b6079bc8038569b9fdaf4efde04f722a1a34b7e498fae82828cdc4646c342ef8963391c4

        • memory/392-185-0x0000000005A00000-0x0000000005A10000-memory.dmp

          Filesize

          64KB

        • memory/392-177-0x0000000005A00000-0x0000000005A10000-memory.dmp

          Filesize

          64KB

        • memory/392-176-0x00000000737F0000-0x0000000073FA0000-memory.dmp

          Filesize

          7.7MB

        • memory/392-181-0x0000000007070000-0x000000000707A000-memory.dmp

          Filesize

          40KB

        • memory/392-184-0x00000000737F0000-0x0000000073FA0000-memory.dmp

          Filesize

          7.7MB

        • memory/756-165-0x0000000005B20000-0x0000000005B2E000-memory.dmp

          Filesize

          56KB

        • memory/756-156-0x0000000000F10000-0x0000000000F56000-memory.dmp

          Filesize

          280KB

        • memory/756-164-0x0000000005B50000-0x0000000005B88000-memory.dmp

          Filesize

          224KB

        • memory/756-162-0x0000000005850000-0x0000000005860000-memory.dmp

          Filesize

          64KB

        • memory/756-157-0x00000000737F0000-0x0000000073FA0000-memory.dmp

          Filesize

          7.7MB

        • memory/756-163-0x0000000005B00000-0x0000000005B08000-memory.dmp

          Filesize

          32KB

        • memory/756-168-0x0000000005850000-0x0000000005860000-memory.dmp

          Filesize

          64KB

        • memory/756-183-0x0000000005850000-0x0000000005860000-memory.dmp

          Filesize

          64KB

        • memory/756-182-0x0000000005850000-0x0000000005860000-memory.dmp

          Filesize

          64KB

        • memory/756-179-0x00000000737F0000-0x0000000073FA0000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-167-0x0000000005EF0000-0x0000000005F02000-memory.dmp

          Filesize

          72KB

        • memory/4824-159-0x0000000005700000-0x0000000005CA4000-memory.dmp

          Filesize

          5.6MB

        • memory/4824-178-0x00000000737F0000-0x0000000073FA0000-memory.dmp

          Filesize

          7.7MB

        • memory/4824-160-0x00000000051F0000-0x0000000005282000-memory.dmp

          Filesize

          584KB

        • memory/4824-158-0x00000000007A0000-0x0000000000840000-memory.dmp

          Filesize

          640KB

        • memory/4824-161-0x00000000050B0000-0x00000000050C0000-memory.dmp

          Filesize

          64KB

        • memory/4824-169-0x0000000006330000-0x000000000636C000-memory.dmp

          Filesize

          240KB

        • memory/4824-166-0x0000000005150000-0x00000000051B6000-memory.dmp

          Filesize

          408KB

        • memory/4824-155-0x00000000737F0000-0x0000000073FA0000-memory.dmp

          Filesize

          7.7MB