Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-03-2024 22:29

General

  • Target

    bcf82013e39cef4310eb312625ab8598.exe

  • Size

    157KB

  • MD5

    bcf82013e39cef4310eb312625ab8598

  • SHA1

    96f423ba66892855a6d67e96a23bdba885f63944

  • SHA256

    088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0

  • SHA512

    1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3

  • SSDEEP

    3072:GfckI9Z12hDq4SWe06jQ75GKqEcjk0XkhFBx4:K0Z12jjM400Tw

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Games

C2

services18.dns.army:7000

ss1999.64-b.it:7000

Mutex

5EwVZpKkbJ5fq0j9og

Attributes
  • encryption_key

    O6mxl5VNcg9uGSOey4nY

  • install_name

    Instalation Rep.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Firefox Update

  • subdirectory

    Instalation

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe
    "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:2568
    • C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
      "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2588
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat" "
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:2444
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:2500
          • C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe
            "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"
            4⤵
            • Executes dropped EXE
            PID:2976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1492
          3⤵
          • Loads dropped DLL
          • Program crash
          PID:2424

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0EPIBWDmBjQw.bat

      Filesize

      221B

      MD5

      3be8d4a1fd7a726dfa34a9566cad25db

      SHA1

      2f3bbc1db68b662572bd4f0130225bd60f79363a

      SHA256

      04d97a0f0230637e659531ec71875766b92445fd491ac4bc621b0b782a4f9b8b

      SHA512

      4d423109524fa9894205444cf465caa3ff47a53655ecdbc4d46e3625286e667b400798e6ac9e28a4ee0b07f8dc75df137b1898673730de0cde7d71fc1c5669c3

    • \Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe

      Filesize

      157KB

      MD5

      bcf82013e39cef4310eb312625ab8598

      SHA1

      96f423ba66892855a6d67e96a23bdba885f63944

      SHA256

      088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0

      SHA512

      1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3

    • memory/1812-11-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1812-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

    • memory/1812-2-0x0000000001D60000-0x0000000001DAC000-memory.dmp

      Filesize

      304KB

    • memory/1812-3-0x0000000004950000-0x0000000004990000-memory.dmp

      Filesize

      256KB

    • memory/1812-0-0x0000000000160000-0x000000000018E000-memory.dmp

      Filesize

      184KB

    • memory/2640-12-0x0000000000C00000-0x0000000000C2E000-memory.dmp

      Filesize

      184KB

    • memory/2640-10-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

    • memory/2640-32-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

    • memory/2640-33-0x0000000004940000-0x0000000004980000-memory.dmp

      Filesize

      256KB

    • memory/2976-30-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB

    • memory/2976-31-0x0000000074470000-0x0000000074B5E000-memory.dmp

      Filesize

      6.9MB