Resubmissions

14/03/2024, 08:55

240314-kvtvjahh65 10

14/03/2024, 07:11

240314-hz14asfg28 10

Analysis

  • max time kernel
    172s
  • max time network
    180s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 08:55

General

  • Target

    c803b24286b85e84999728e62074f29a.exe

  • Size

    832KB

  • MD5

    c803b24286b85e84999728e62074f29a

  • SHA1

    a535987863ef3ffc0bbc5bda52b531fb687f7af8

  • SHA256

    caeadc9fe15c86a04c0cbc13445cf555b14ad95b5d3a4104d62e72fdd371cdb7

  • SHA512

    8007add191fb1bf9b182f6a623b7c3677257d51fe1d133fce5cbb3aa61288dfedd5022b884b1d28fc6730a351da19d4a738edd69d0305739b1e9942da846ef62

  • SSDEEP

    6144:CBIXwYejKKPcAHDMn4xJRBgiBoPysbZbz4DkyNnvBImJ0H9owHbAmw/J4ffMzYVA:PQjdM40btzONp5We5zDSHzBu6/cwbGj

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

rat2000

C2

noelsfreexd.ddns.net:80

noelsfreexd.ddns.net:443

Mutex

QSR_MUTEX_pZaUbVWTnEK2l6CC6k

Attributes
  • encryption_key

    z8mQ697A1LH8Y5CjsRnd

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    2500

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c803b24286b85e84999728e62074f29a.exe
    "C:\Users\Admin\AppData\Local\Temp\c803b24286b85e84999728e62074f29a.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
      "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\cmd.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:1632
      • C:\Windows\SysWOW64\SubDir\Client.exe
        "C:\Windows\SysWOW64\SubDir\Client.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Client.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:1496
        • C:\Users\Admin\AppData\Local\Temp\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\0WRZ4k44txBc.bat" "
          4⤵
          • Executes dropped EXE
          PID:2752
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1492
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2904
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\0WRZ4k44txBc.bat

          Filesize

          196B

          MD5

          8b40d57aec119a37c045dd2d4eabc66e

          SHA1

          49c08719cf7f2e8ae9ebe3c1beb73dfaf17c11d1

          SHA256

          8d9c644b15f78f3b61738a3a8deaf38f7eeccff37eee0bb16394996167af0d68

          SHA512

          6317b618950c8588b1887f50de3a69939a51eceb8b8748aa70f6cec1365b8b7e88cd94b7fd49e7e5c9f98225d31b08dbab7a1c58b61bbd118b3671de4897fae8

        • C:\Users\Admin\AppData\Local\Temp\cmd.exe

          Filesize

          349KB

          MD5

          efb08c8abd228dc2c608b4b2ae81f8e5

          SHA1

          4c132ee66fb7ab5e26989f07d72fbc81d4480f41

          SHA256

          bda07aecc578ff4d3f853070643e8cda8f90c3ecbd73132bc75ee17f70b84863

          SHA512

          b3f8fa4979321dc1cf0032f36cb37c17a63e396fa2f70bd076eff8d32974c9e1b7a0f3ecc6b8b788c56d3cca131dfd3f5e6b938ceadab0cfa1a3d97e941fd962

        • memory/668-53-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

        • memory/668-52-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

        • memory/668-50-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

        • memory/668-49-0x0000000140000000-0x00000001405E8000-memory.dmp

          Filesize

          5.9MB

        • memory/1972-25-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/1972-51-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/1972-29-0x0000000000B00000-0x0000000000B40000-memory.dmp

          Filesize

          256KB

        • memory/1972-28-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/1972-27-0x0000000000B00000-0x0000000000B40000-memory.dmp

          Filesize

          256KB

        • memory/1972-26-0x0000000000E40000-0x0000000000E9E000-memory.dmp

          Filesize

          376KB

        • memory/2464-12-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/2464-11-0x0000000000D10000-0x0000000000D6E000-memory.dmp

          Filesize

          376KB

        • memory/2464-18-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/2464-17-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/2464-24-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/2464-14-0x0000000004C30000-0x0000000004C70000-memory.dmp

          Filesize

          256KB

        • memory/2500-10-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

          Filesize

          9.9MB

        • memory/2500-0-0x0000000000830000-0x00000000008B0000-memory.dmp

          Filesize

          512KB

        • memory/2500-13-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2500-15-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2500-3-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2500-2-0x00000000006E0000-0x00000000006E1000-memory.dmp

          Filesize

          4KB

        • memory/2500-1-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

          Filesize

          9.9MB

        • memory/2752-40-0x0000000000E30000-0x0000000000E8E000-memory.dmp

          Filesize

          376KB

        • memory/2752-41-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB

        • memory/2752-42-0x0000000004A20000-0x0000000004A60000-memory.dmp

          Filesize

          256KB

        • memory/2752-48-0x0000000073CB0000-0x000000007439E000-memory.dmp

          Filesize

          6.9MB