Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 22:29
Behavioral task
behavioral1
Sample
bcf82013e39cef4310eb312625ab8598.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bcf82013e39cef4310eb312625ab8598.exe
Resource
win10v2004-20240226-en
General
-
Target
bcf82013e39cef4310eb312625ab8598.exe
-
Size
157KB
-
MD5
bcf82013e39cef4310eb312625ab8598
-
SHA1
96f423ba66892855a6d67e96a23bdba885f63944
-
SHA256
088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
-
SHA512
1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3
-
SSDEEP
3072:GfckI9Z12hDq4SWe06jQ75GKqEcjk0XkhFBx4:K0Z12jjM400Tw
Malware Config
Extracted
quasar
1.4.0.0
Games
services18.dns.army:7000
ss1999.64-b.it:7000
5EwVZpKkbJ5fq0j9og
-
encryption_key
O6mxl5VNcg9uGSOey4nY
-
install_name
Instalation Rep.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Firefox Update
-
subdirectory
Instalation
Signatures
-
Quasar payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-0-0x0000000000160000-0x000000000018E000-memory.dmp family_quasar behavioral1/memory/1812-2-0x0000000001D60000-0x0000000001DAC000-memory.dmp family_quasar behavioral1/memory/1812-3-0x0000000004950000-0x0000000004990000-memory.dmp family_quasar \Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe family_quasar behavioral1/memory/2640-12-0x0000000000C00000-0x0000000000C2E000-memory.dmp family_quasar -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Executes dropped EXE 2 IoCs
Processes:
Instalation Rep.exeInstalation Rep.exepid process 2640 Instalation Rep.exe 2976 Instalation Rep.exe -
Loads dropped DLL 7 IoCs
Processes:
bcf82013e39cef4310eb312625ab8598.exeWerFault.execmd.exepid process 1812 bcf82013e39cef4310eb312625ab8598.exe 2424 WerFault.exe 2424 WerFault.exe 2424 WerFault.exe 2424 WerFault.exe 2424 WerFault.exe 2472 cmd.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2424 2640 WerFault.exe Instalation Rep.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2568 schtasks.exe 2588 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bcf82013e39cef4310eb312625ab8598.exeInstalation Rep.exedescription pid process Token: SeDebugPrivilege 1812 bcf82013e39cef4310eb312625ab8598.exe Token: SeDebugPrivilege 2640 Instalation Rep.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Instalation Rep.exepid process 2640 Instalation Rep.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
bcf82013e39cef4310eb312625ab8598.exeInstalation Rep.execmd.exedescription pid process target process PID 1812 wrote to memory of 2568 1812 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 1812 wrote to memory of 2568 1812 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 1812 wrote to memory of 2568 1812 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 1812 wrote to memory of 2568 1812 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 1812 wrote to memory of 2640 1812 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 2640 wrote to memory of 2588 2640 Instalation Rep.exe schtasks.exe PID 2640 wrote to memory of 2588 2640 Instalation Rep.exe schtasks.exe PID 2640 wrote to memory of 2588 2640 Instalation Rep.exe schtasks.exe PID 2640 wrote to memory of 2588 2640 Instalation Rep.exe schtasks.exe PID 2640 wrote to memory of 2472 2640 Instalation Rep.exe cmd.exe PID 2640 wrote to memory of 2472 2640 Instalation Rep.exe cmd.exe PID 2640 wrote to memory of 2472 2640 Instalation Rep.exe cmd.exe PID 2640 wrote to memory of 2472 2640 Instalation Rep.exe cmd.exe PID 2472 wrote to memory of 2444 2472 cmd.exe chcp.com PID 2472 wrote to memory of 2444 2472 cmd.exe chcp.com PID 2472 wrote to memory of 2444 2472 cmd.exe chcp.com PID 2472 wrote to memory of 2444 2472 cmd.exe chcp.com PID 2640 wrote to memory of 2424 2640 Instalation Rep.exe WerFault.exe PID 2640 wrote to memory of 2424 2640 Instalation Rep.exe WerFault.exe PID 2640 wrote to memory of 2424 2640 Instalation Rep.exe WerFault.exe PID 2640 wrote to memory of 2424 2640 Instalation Rep.exe WerFault.exe PID 2472 wrote to memory of 2500 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2500 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2500 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2500 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe PID 2472 wrote to memory of 2976 2472 cmd.exe Instalation Rep.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2568 -
C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2588 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:2444
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
PID:2500 -
C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"4⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 14923⤵
- Loads dropped DLL
- Program crash
PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221B
MD53be8d4a1fd7a726dfa34a9566cad25db
SHA12f3bbc1db68b662572bd4f0130225bd60f79363a
SHA25604d97a0f0230637e659531ec71875766b92445fd491ac4bc621b0b782a4f9b8b
SHA5124d423109524fa9894205444cf465caa3ff47a53655ecdbc4d46e3625286e667b400798e6ac9e28a4ee0b07f8dc75df137b1898673730de0cde7d71fc1c5669c3
-
Filesize
157KB
MD5bcf82013e39cef4310eb312625ab8598
SHA196f423ba66892855a6d67e96a23bdba885f63944
SHA256088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
SHA5121cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3