Resubmissions

14/03/2024, 08:55

240314-kvtvjahh65 10

14/03/2024, 07:11

240314-hz14asfg28 10

Analysis

  • max time kernel
    148s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 07:11

General

  • Target

    c803b24286b85e84999728e62074f29a.exe

  • Size

    832KB

  • MD5

    c803b24286b85e84999728e62074f29a

  • SHA1

    a535987863ef3ffc0bbc5bda52b531fb687f7af8

  • SHA256

    caeadc9fe15c86a04c0cbc13445cf555b14ad95b5d3a4104d62e72fdd371cdb7

  • SHA512

    8007add191fb1bf9b182f6a623b7c3677257d51fe1d133fce5cbb3aa61288dfedd5022b884b1d28fc6730a351da19d4a738edd69d0305739b1e9942da846ef62

  • SSDEEP

    6144:CBIXwYejKKPcAHDMn4xJRBgiBoPysbZbz4DkyNnvBImJ0H9owHbAmw/J4ffMzYVA:PQjdM40btzONp5We5zDSHzBu6/cwbGj

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

rat2000

C2

noelsfreexd.ddns.net:80

noelsfreexd.ddns.net:443

Mutex

QSR_MUTEX_pZaUbVWTnEK2l6CC6k

Attributes
  • encryption_key

    z8mQ697A1LH8Y5CjsRnd

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    2500

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c803b24286b85e84999728e62074f29a.exe
    "C:\Users\Admin\AppData\Local\Temp\c803b24286b85e84999728e62074f29a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
      "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\cmd.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2568
      • C:\Windows\SysWOW64\SubDir\Client.exe
        "C:\Windows\SysWOW64\SubDir\Client.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Client.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:2520
        • C:\Users\Admin\AppData\Local\Temp\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\2BTW532LGeSG.bat" "
          4⤵
          • Executes dropped EXE
          PID:2756
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 1448
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2924

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\2BTW532LGeSG.bat

          Filesize

          196B

          MD5

          80377756ee1e0edbfe89bfd4042f8720

          SHA1

          cb9272a2c7ba44f736ffa836a3e5315acc1c7dbc

          SHA256

          17b3800dc79eaac3cdf1616e06b71693d346e8171e256d1a82b5b0cdb7df6571

          SHA512

          17b1f6516119b02c8483238a9a2553d3e9042fbd0da3a9f40703ef1fe9dcd78f1f86b9c3b269e5fe57fecaca0272e6405088c56d4af5728a752b02739c99efbe

        • C:\Users\Admin\AppData\Local\Temp\cmd.exe

          Filesize

          349KB

          MD5

          efb08c8abd228dc2c608b4b2ae81f8e5

          SHA1

          4c132ee66fb7ab5e26989f07d72fbc81d4480f41

          SHA256

          bda07aecc578ff4d3f853070643e8cda8f90c3ecbd73132bc75ee17f70b84863

          SHA512

          b3f8fa4979321dc1cf0032f36cb37c17a63e396fa2f70bd076eff8d32974c9e1b7a0f3ecc6b8b788c56d3cca131dfd3f5e6b938ceadab0cfa1a3d97e941fd962

        • memory/2240-43-0x000000001B4E0000-0x000000001B560000-memory.dmp

          Filesize

          512KB

        • memory/2240-3-0x000000001B4E0000-0x000000001B560000-memory.dmp

          Filesize

          512KB

        • memory/2240-2-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

        • memory/2240-44-0x000000001B4E0000-0x000000001B560000-memory.dmp

          Filesize

          512KB

        • memory/2240-42-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

          Filesize

          9.9MB

        • memory/2240-0-0x0000000001250000-0x00000000012D0000-memory.dmp

          Filesize

          512KB

        • memory/2240-1-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

          Filesize

          9.9MB

        • memory/2756-33-0x0000000000CE0000-0x0000000000D3E000-memory.dmp

          Filesize

          376KB

        • memory/2756-41-0x0000000074150000-0x000000007483E000-memory.dmp

          Filesize

          6.9MB

        • memory/2756-35-0x0000000004B70000-0x0000000004BB0000-memory.dmp

          Filesize

          256KB

        • memory/2756-34-0x0000000074150000-0x000000007483E000-memory.dmp

          Filesize

          6.9MB

        • memory/2828-21-0x0000000000100000-0x000000000015E000-memory.dmp

          Filesize

          376KB

        • memory/2828-22-0x0000000004B90000-0x0000000004BD0000-memory.dmp

          Filesize

          256KB

        • memory/2828-20-0x0000000074150000-0x000000007483E000-memory.dmp

          Filesize

          6.9MB

        • memory/2828-45-0x0000000074150000-0x000000007483E000-memory.dmp

          Filesize

          6.9MB

        • memory/2828-46-0x0000000004B90000-0x0000000004BD0000-memory.dmp

          Filesize

          256KB

        • memory/3068-19-0x0000000074150000-0x000000007483E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-12-0x0000000004A10000-0x0000000004A50000-memory.dmp

          Filesize

          256KB

        • memory/3068-11-0x0000000074150000-0x000000007483E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-10-0x0000000000BC0000-0x0000000000C1E000-memory.dmp

          Filesize

          376KB