Analysis
-
max time kernel
300s -
max time network
311s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
-
submitted
19-09-2023 03:45
General
-
Target
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe
-
Size
3.1MB
-
MD5
28e03a0e0871a90ee993db029c25ded5
-
SHA1
651f0c06a5d0bf37a8a7987626a89135b5384459
-
SHA256
51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
-
SHA512
c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60
-
SSDEEP
49152:q+4bzTvij0votBkRPJMMB+9YUkSk+yfzBcpoG9SbTHHB72eh2NT:q+i/i5tBkRPJMM2YUkSk5u
Malware Config
Extracted
quasar
1.4.1
cunt
37.139.129.145:5512
37.139.129.145:5505
5a092138-836c-4206-9af6-8a540736ef07
-
encryption_key
D21B49539C3EA494897D43CF75CBF5F989F0792A
-
install_name
ntoskrnl.exe
-
log_directory
SystemLogs
-
reconnect_delay
3000
-
startup_key
Kernel
-
subdirectory
Kernel
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 3 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (54) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe"C:\Users\Admin\AppData\Local\Temp\51220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Kernel" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe"C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Kernel" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Kernel\ntoskrnl.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\JUNfRnCbnBiS.exe"C:\Users\Admin\AppData\Local\Temp\JUNfRnCbnBiS.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JUNfRnCbnBiS.exe"C:\Users\Admin\AppData\Local\Temp\JUNfRnCbnBiS.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off5⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable5⤵
- Modifies Windows Firewall
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD52f244a56091c9705794e92e6bcc38058
SHA13f2b518be764f29c66ba8564d1be8f4309cce747
SHA256e322feefa8d4c76d8749f88c9b877e3e119418c4ac0b18a8cfb7260638cc588d
SHA5123ee3835abfec9c2db4ba1f33b5e59db2400e712d5dd7cde82a12889ea1beab8ac85b923ec0447e81b3d2ce3ebd14922882653f5bcdcc81a29f225acfa4872572
-
Filesize
57B
MD5ab9d8ef2ffa9145d6c325cefa41d5d4e
SHA10f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab
SHA25665a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785
SHA512904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100
-
Filesize
24B
MD51681ffc6e046c7af98c9e6c232a3fe0a
SHA1d3399b7262fb56cb9ed053d68db9291c410839c4
SHA2569d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA51211bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5
-
Filesize
56KB
MD548ecb8dcb214011b5e89e18fa76e6440
SHA1ccf1384b9ae04c909eee5e4a3d6cc1000ad135d5
SHA256362b89161b579321c0780e35f0f24ac9f5128a4b27f263319a3900ae431ff87c
SHA512a72d97127566acb1eaf53a810ed828ca17685221c39259e2849de045c36c4c5b8c8481cdf3d9404998e82a51efb8618d44114f016c8eb2f6b0a03ec6fe56369d
-
Filesize
56KB
MD548ecb8dcb214011b5e89e18fa76e6440
SHA1ccf1384b9ae04c909eee5e4a3d6cc1000ad135d5
SHA256362b89161b579321c0780e35f0f24ac9f5128a4b27f263319a3900ae431ff87c
SHA512a72d97127566acb1eaf53a810ed828ca17685221c39259e2849de045c36c4c5b8c8481cdf3d9404998e82a51efb8618d44114f016c8eb2f6b0a03ec6fe56369d
-
Filesize
56KB
MD548ecb8dcb214011b5e89e18fa76e6440
SHA1ccf1384b9ae04c909eee5e4a3d6cc1000ad135d5
SHA256362b89161b579321c0780e35f0f24ac9f5128a4b27f263319a3900ae431ff87c
SHA512a72d97127566acb1eaf53a810ed828ca17685221c39259e2849de045c36c4c5b8c8481cdf3d9404998e82a51efb8618d44114f016c8eb2f6b0a03ec6fe56369d
-
Filesize
3.1MB
MD528e03a0e0871a90ee993db029c25ded5
SHA1651f0c06a5d0bf37a8a7987626a89135b5384459
SHA25651220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
SHA512c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60
-
Filesize
3.1MB
MD528e03a0e0871a90ee993db029c25ded5
SHA1651f0c06a5d0bf37a8a7987626a89135b5384459
SHA25651220927e71a1b8c5cc0ca85c454dc93f3aaae25bb3ec0dc3a9837236687d45f
SHA512c13997f114735d9db85205b7b76f5236c0721babd850528bd066d0ed0059bd82650008bf52a8172a9a183ad8b90beb16c39b682511c6750d896ef99c10a57a60
-
Filesize
56KB
MD548ecb8dcb214011b5e89e18fa76e6440
SHA1ccf1384b9ae04c909eee5e4a3d6cc1000ad135d5
SHA256362b89161b579321c0780e35f0f24ac9f5128a4b27f263319a3900ae431ff87c
SHA512a72d97127566acb1eaf53a810ed828ca17685221c39259e2849de045c36c4c5b8c8481cdf3d9404998e82a51efb8618d44114f016c8eb2f6b0a03ec6fe56369d
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
712KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
3.1MB
-
Filesize
64KB
-
Filesize
9.9MB