Analysis

  • max time kernel
    57s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2023 18:10

General

  • Target

    Electron.exe

  • Size

    3.2MB

  • MD5

    5dd7500f21add8f9bc322529a35cb55f

  • SHA1

    b12eec8fdf6224f65e27fb9d9b06dc4375e1b37b

  • SHA256

    48d2d3e579bbcddda54aa5bd48197b179ca7b75018d05ce12ff3cf9e7b78e40e

  • SHA512

    dfbbb5b026e46dd5569814f6e8558678808bf9d4d7c8d4949f8943bb7eb92ecea8f2abfc0f9f2becdd0d2f04b61000262f20e2af87a11e3fc8d4931879633e3b

  • SSDEEP

    98304:/veL26AaNeWgPhlmVqkQ7XSKB3OzLRCL:3e4SlPgL

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

limehag920-33288.portmap.host:33288

Mutex

9818b060-d6e3-4e48-b21e-c9ef7bc65511

Attributes
  • encryption_key

    E97F64327412A3864CF0B0BE4A85415B949C39AD

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Electron.exe
    "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\hpO5htDnpGk2.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2592
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • Runs ping.exe
          PID:2648
        • C:\Users\Admin\AppData\Local\Temp\Electron.exe
          "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2452
          • C:\Windows\system32\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\IoHqLxysdlFf.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2508
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:2500
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                5⤵
                • Runs ping.exe
                PID:2516
              • C:\Users\Admin\AppData\Local\Temp\Electron.exe
                "C:\Users\Admin\AppData\Local\Temp\Electron.exe"
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2908
                • C:\Windows\system32\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\blBgpvBxu9wo.bat" "
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1260
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    7⤵
                      PID:1680
                    • C:\Windows\system32\PING.EXE
                      ping -n 10 localhost
                      7⤵
                      • Runs ping.exe
                      PID:1524

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IoHqLxysdlFf.bat

          Filesize

          205B

          MD5

          bd23869efcf526ba54b33e6e09f36e39

          SHA1

          ee4f301b3acc73fe01f9662f7f1d3b2618e90ad4

          SHA256

          0dc22cf7eb9f0763d13c4f99af839b9a56e8462edf20ce4aec55b37f14c30872

          SHA512

          1b29637d210281d1a44a51bb79f977b3aaa3db0ea62a75236e7801a632d602fc42ae301736059ba234526e89d244be5eacaf72c08c8494761a4fb4503adc45c0

        • C:\Users\Admin\AppData\Local\Temp\IoHqLxysdlFf.bat

          Filesize

          205B

          MD5

          bd23869efcf526ba54b33e6e09f36e39

          SHA1

          ee4f301b3acc73fe01f9662f7f1d3b2618e90ad4

          SHA256

          0dc22cf7eb9f0763d13c4f99af839b9a56e8462edf20ce4aec55b37f14c30872

          SHA512

          1b29637d210281d1a44a51bb79f977b3aaa3db0ea62a75236e7801a632d602fc42ae301736059ba234526e89d244be5eacaf72c08c8494761a4fb4503adc45c0

        • C:\Users\Admin\AppData\Local\Temp\blBgpvBxu9wo.bat

          Filesize

          205B

          MD5

          1b36941dbe83917e59a7c1ac67ec137b

          SHA1

          3c299e1211b72f2691b909593c52f3f0adb5c227

          SHA256

          80cd1cceae84f67bdb1c6e05c94bb605e9ae3d8a0f32c9d2d6ea86d75feb8194

          SHA512

          32e7dd8676cb20d0fce9df70025ad2dbbfac6acf854f42cf57d97ab8e805b0bdde1c4751f757d37506d4707f03832d041a8762178a061f2b30ede5ac9dac096d

        • C:\Users\Admin\AppData\Local\Temp\blBgpvBxu9wo.bat

          Filesize

          205B

          MD5

          1b36941dbe83917e59a7c1ac67ec137b

          SHA1

          3c299e1211b72f2691b909593c52f3f0adb5c227

          SHA256

          80cd1cceae84f67bdb1c6e05c94bb605e9ae3d8a0f32c9d2d6ea86d75feb8194

          SHA512

          32e7dd8676cb20d0fce9df70025ad2dbbfac6acf854f42cf57d97ab8e805b0bdde1c4751f757d37506d4707f03832d041a8762178a061f2b30ede5ac9dac096d

        • C:\Users\Admin\AppData\Local\Temp\hpO5htDnpGk2.bat

          Filesize

          205B

          MD5

          42a6b84a629f43ba0b6975630c4e1b9a

          SHA1

          afebd750aa592dd37510ef0f43a73112b182156b

          SHA256

          335dc0a008c51c136d84dc5fdfd9528fb91a4dac5268c934745227383aeb36ae

          SHA512

          7432bf9cb418e67296064192f3e3ad6168a7406c519bea3435e55034af0d7d3465dad09ed092be89a3eb5982adb85086ac563655d80c1af53091f82575be21bb

        • C:\Users\Admin\AppData\Local\Temp\hpO5htDnpGk2.bat

          Filesize

          205B

          MD5

          42a6b84a629f43ba0b6975630c4e1b9a

          SHA1

          afebd750aa592dd37510ef0f43a73112b182156b

          SHA256

          335dc0a008c51c136d84dc5fdfd9528fb91a4dac5268c934745227383aeb36ae

          SHA512

          7432bf9cb418e67296064192f3e3ad6168a7406c519bea3435e55034af0d7d3465dad09ed092be89a3eb5982adb85086ac563655d80c1af53091f82575be21bb

        • memory/2148-1-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

          Filesize

          9.9MB

        • memory/2148-2-0x000000001B2E0000-0x000000001B360000-memory.dmp

          Filesize

          512KB

        • memory/2148-12-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

          Filesize

          9.9MB

        • memory/2148-0-0x0000000000E90000-0x00000000011C4000-memory.dmp

          Filesize

          3.2MB

        • memory/2452-15-0x000000001B340000-0x000000001B3C0000-memory.dmp

          Filesize

          512KB

        • memory/2452-25-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

          Filesize

          9.9MB

        • memory/2452-13-0x0000000000360000-0x0000000000694000-memory.dmp

          Filesize

          3.2MB

        • memory/2452-14-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

          Filesize

          9.9MB

        • memory/2908-26-0x0000000001050000-0x0000000001384000-memory.dmp

          Filesize

          3.2MB

        • memory/2908-28-0x0000000000C90000-0x0000000000D10000-memory.dmp

          Filesize

          512KB

        • memory/2908-27-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

          Filesize

          9.9MB

        • memory/2908-38-0x000007FEF5270000-0x000007FEF5C5C000-memory.dmp

          Filesize

          9.9MB