Analysis
-
max time kernel
78s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/03/2024, 09:05
General
-
Target
HyperWare_protected.exe
-
Size
5.0MB
-
MD5
9e9a6f9a90c1fa79bd9a09345b31b9ab
-
SHA1
3e9409d409256f02efed1b52f527d4a6791d0926
-
SHA256
9020aae0a31cd7145e594a192a1b378f5265ff12a30173a0781c2bd28e4a2db0
-
SHA512
2637991f9cb9919143e5d9fbf9973035e9ba2ae97a1c8c3e7257f3e67e5cf3695a084045b18f81fc2b461524e17bca88e1a8039b780b4a5cb9d8cbbcb39eec62
-
SSDEEP
98304:im309bAHMZH4Wv3iV21iP8Rsjax0mLK7ObppdX:X309bhlvTm8Rsjau37ObpHX
Malware Config
Extracted
quasar
1.4.1
Office04
80.222.152.67:4782
b1211cdc-e7ee-41df-a882-918ae7c97f3c
-
encryption_key
A684ADED669CF87DBFCB7333A13FCD58A8471D17
-
install_name
HyperUD.exe
-
log_directory
AppdataLog
-
reconnect_delay
3000
-
startup_key
Steam Client Webhelper
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 7 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HyperWare_protected.exe"C:\Users\Admin\AppData\Local\Temp\HyperWare_protected.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Steam Client Webhelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\HyperUD.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\SubDir\HyperUD.exe"C:\Windows\system32\SubDir\HyperUD.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5a0a7c5d49e10f25a28c6bd824def240a
SHA144e07a35bd69b2ace3787d609ae7af5aab4f1775
SHA256c81b09cc6f30170e07c606667290d2fb1bc83e533becefba7e0549901c9f7963
SHA51207206ec8f4632dc4b670ebfa169020d47f8c9a473b7bd90da70d974f76530a8f87b0865f4c4e0bd64a851b6dc9354c94484a6c68bb3f5cb3344dc9fffe798b95
-
Filesize
5.0MB
MD59e9a6f9a90c1fa79bd9a09345b31b9ab
SHA13e9409d409256f02efed1b52f527d4a6791d0926
SHA2569020aae0a31cd7145e594a192a1b378f5265ff12a30173a0781c2bd28e4a2db0
SHA5122637991f9cb9919143e5d9fbf9973035e9ba2ae97a1c8c3e7257f3e67e5cf3695a084045b18f81fc2b461524e17bca88e1a8039b780b4a5cb9d8cbbcb39eec62
-
Filesize
960KB
-
Filesize
13.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
960KB
-
Filesize
13.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
13.1MB
-
Filesize
960KB
-
Filesize
40KB
-
Filesize
960KB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
13.1MB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB