Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231130-en
  • resource tags

    arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
  • submitted
    06-12-2023 10:19

General

  • Target

    94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe

  • Size

    829KB

  • MD5

    2abed91ee9611fdd5cd6118f465e18e9

  • SHA1

    0fe598bbc219da65715fe26a4722a427c63ac5b7

  • SHA256

    94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1

  • SHA512

    f1ef8e168c19e1840aef0a2db653cd12c3955dbe7fc389fc0ba307b05638d0340704a724c7154920351462ea7b61e71ab24f8b20450696605d275ebbd8a81e0f

  • SSDEEP

    12288:XueH5qgRSJZl5v7ehH0Xg3hLZ4miAJMY72RUC9lXudcXuXhUguwL0t8WIp7VMyam:FqgRml5j0UXgxl4mZDkUCDgEvm

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

labtek.duckdns.org:4782

Mutex

QSR_MUTEX_Pc805LzmblzcJtBoEi

Attributes
  • encryption_key

    9WuVWCumPUdQwI1jN0XT

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
    "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
      "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AQYRvCRhgNGF.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:1928
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:2036
          • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
            "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1104
            • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
              "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
              5⤵
                PID:1788
              • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
                "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
                5⤵
                  PID:956
                • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
                  "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
                  5⤵
                    PID:1760
                  • C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe
                    "C:\Users\Admin\AppData\Local\Temp\94760527e46bc9d39c50660df70b59c6e711cc4d3574ac5499e622fffd9efae1.exe"
                    5⤵
                      PID:1192
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1472
                  3⤵
                  • Program crash
                  PID:2944

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\AQYRvCRhgNGF.bat

              Filesize

              261B

              MD5

              28aab5f36c545a2016fd1f5ea3be4fde

              SHA1

              6cb27bcd5918ab3d5275899ddf6f32eecbcf2ee6

              SHA256

              f557c0101b62d143917bd6cc0866318680ea818a59cededa89512b9ce059242a

              SHA512

              44f27ad2d10e0b8a212fea1cc5a6f93287fb58038e633b3c335b701e36a7555f932cb26d6b7c64bd36fa2c3d37d1391e62fa687b41a37889d8dbb9bebfa5626c

            • C:\Users\Admin\AppData\Local\Temp\AQYRvCRhgNGF.bat

              Filesize

              261B

              MD5

              28aab5f36c545a2016fd1f5ea3be4fde

              SHA1

              6cb27bcd5918ab3d5275899ddf6f32eecbcf2ee6

              SHA256

              f557c0101b62d143917bd6cc0866318680ea818a59cededa89512b9ce059242a

              SHA512

              44f27ad2d10e0b8a212fea1cc5a6f93287fb58038e633b3c335b701e36a7555f932cb26d6b7c64bd36fa2c3d37d1391e62fa687b41a37889d8dbb9bebfa5626c

            • memory/1104-48-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/1104-38-0x0000000004DF0000-0x0000000004E30000-memory.dmp

              Filesize

              256KB

            • memory/1104-37-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/1104-36-0x0000000004DF0000-0x0000000004E30000-memory.dmp

              Filesize

              256KB

            • memory/1104-35-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/1192-53-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/1192-52-0x00000000045F0000-0x0000000004630000-memory.dmp

              Filesize

              256KB

            • memory/1192-51-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/2208-8-0x0000000004C00000-0x0000000004C40000-memory.dmp

              Filesize

              256KB

            • memory/2208-0-0x0000000000170000-0x0000000000246000-memory.dmp

              Filesize

              856KB

            • memory/2208-1-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/2208-21-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/2208-2-0x0000000004C00000-0x0000000004C40000-memory.dmp

              Filesize

              256KB

            • memory/2208-3-0x00000000004B0000-0x00000000004CA000-memory.dmp

              Filesize

              104KB

            • memory/2208-4-0x00000000004D0000-0x00000000004D8000-memory.dmp

              Filesize

              32KB

            • memory/2208-5-0x0000000000520000-0x000000000052A000-memory.dmp

              Filesize

              40KB

            • memory/2208-6-0x00000000051D0000-0x0000000005268000-memory.dmp

              Filesize

              608KB

            • memory/2208-7-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/3032-17-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3032-24-0x0000000002010000-0x0000000002050000-memory.dmp

              Filesize

              256KB

            • memory/3032-10-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3032-9-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3032-23-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/3032-12-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3032-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

            • memory/3032-15-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3032-11-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB

            • memory/3032-22-0x0000000002010000-0x0000000002050000-memory.dmp

              Filesize

              256KB

            • memory/3032-20-0x0000000074410000-0x0000000074AFE000-memory.dmp

              Filesize

              6.9MB

            • memory/3032-19-0x0000000000400000-0x000000000045E000-memory.dmp

              Filesize

              376KB