Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 22:39

General

  • Target

    579ebb1309ad953fa0cb52c33b190baa.exe

  • Size

    786KB

  • MD5

    579ebb1309ad953fa0cb52c33b190baa

  • SHA1

    70ccb8c950d96a7e6c32d09c307227f271a627ba

  • SHA256

    54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781

  • SHA512

    2b9d5413626358fae10013e2fd214ec5e66cf7c30665f896563a39f3564ef475cbda8de14cb6f9260d5f49b70a1967d1097c0f855e7985ebed78d2a0c25390d4

  • SSDEEP

    24576:6O7r0f+STf0QcR9CTsPsOcs1kITzH9FHB2PpO:6gAf+YMQceTs1t1/TzdFh20

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

83.147.53.145:3700

Mutex

QSR_MUTEX_6WQThXDTXhAO4iLfWV

Attributes
  • encryption_key

    rylGzNSu4oGtwQbffX0U

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
    "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2300
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YXiUvROAyTyYWN.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YXiUvROAyTyYWN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3AA0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2708
    • C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
      "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2816
      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1952
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YXiUvROAyTyYWN.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1368
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YXiUvROAyTyYWN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp68F0.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:2228
        • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp3AA0.tmp

    Filesize

    1KB

    MD5

    6c530173ae54625f912a357f67f673ff

    SHA1

    c48fb4cce1c31569c53be05783d8f73ee7655dff

    SHA256

    50be067c08cc7588dffbed76b98feb820fb78edbd75b1a7c17258228dd46e797

    SHA512

    1b663466560d74b4e43ac3151ac52dda4b0110694aa8ad76922a84b303300f4519b109361dccf886ffbc83890e2b7b0c1242e8b2de3f3836af891a75f3b2dcfb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZU59CYVRCZ1ESQDX8VQ0.temp

    Filesize

    7KB

    MD5

    94edd14bd440682f0117bb5838309694

    SHA1

    0a68f58ee79bb7b75330780f62d79f36fec4a78b

    SHA256

    28a2f0d9696a750b0da53d6e279bac952ac7742e8e663902aa0d0372f222a0c6

    SHA512

    b40fdb6f16f4b16eb5fee1535e1879b0f2698d258c784f1104fc16123625f65c493f7355bbbb485bcc4e22f9021a613f5a09b0a1b59b1863a31da020b79e9b47

  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

    Filesize

    786KB

    MD5

    579ebb1309ad953fa0cb52c33b190baa

    SHA1

    70ccb8c950d96a7e6c32d09c307227f271a627ba

    SHA256

    54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781

    SHA512

    2b9d5413626358fae10013e2fd214ec5e66cf7c30665f896563a39f3564ef475cbda8de14cb6f9260d5f49b70a1967d1097c0f855e7985ebed78d2a0c25390d4

  • memory/1368-71-0x0000000002600000-0x0000000002640000-memory.dmp

    Filesize

    256KB

  • memory/1368-73-0x000000006EFD0000-0x000000006F57B000-memory.dmp

    Filesize

    5.7MB

  • memory/1368-70-0x0000000002600000-0x0000000002640000-memory.dmp

    Filesize

    256KB

  • memory/1368-69-0x0000000002600000-0x0000000002640000-memory.dmp

    Filesize

    256KB

  • memory/1368-93-0x000000006EFD0000-0x000000006F57B000-memory.dmp

    Filesize

    5.7MB

  • memory/1368-85-0x000000006EFD0000-0x000000006F57B000-memory.dmp

    Filesize

    5.7MB

  • memory/1916-80-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1916-96-0x00000000003C0000-0x0000000000400000-memory.dmp

    Filesize

    256KB

  • memory/1916-95-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/1916-92-0x00000000003C0000-0x0000000000400000-memory.dmp

    Filesize

    256KB

  • memory/1916-91-0x00000000737A0000-0x0000000073E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-87-0x0000000074AA0000-0x000000007518E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-50-0x0000000074AA0000-0x000000007518E000-memory.dmp

    Filesize

    6.9MB

  • memory/1936-52-0x0000000000AE0000-0x0000000000BAA000-memory.dmp

    Filesize

    808KB

  • memory/1936-53-0x0000000002240000-0x0000000002280000-memory.dmp

    Filesize

    256KB

  • memory/1952-67-0x000000006EFD0000-0x000000006F57B000-memory.dmp

    Filesize

    5.7MB

  • memory/1952-90-0x000000006EFD0000-0x000000006F57B000-memory.dmp

    Filesize

    5.7MB

  • memory/1952-68-0x0000000002970000-0x00000000029B0000-memory.dmp

    Filesize

    256KB

  • memory/1952-60-0x000000006EFD0000-0x000000006F57B000-memory.dmp

    Filesize

    5.7MB

  • memory/1952-66-0x0000000002970000-0x00000000029B0000-memory.dmp

    Filesize

    256KB

  • memory/2300-35-0x0000000002C50000-0x0000000002C90000-memory.dmp

    Filesize

    256KB

  • memory/2300-37-0x000000006E570000-0x000000006EB1B000-memory.dmp

    Filesize

    5.7MB

  • memory/2300-33-0x000000006E570000-0x000000006EB1B000-memory.dmp

    Filesize

    5.7MB

  • memory/2300-38-0x0000000002C50000-0x0000000002C90000-memory.dmp

    Filesize

    256KB

  • memory/2300-42-0x000000006E570000-0x000000006EB1B000-memory.dmp

    Filesize

    5.7MB

  • memory/2356-32-0x0000000074AA0000-0x000000007518E000-memory.dmp

    Filesize

    6.9MB

  • memory/2356-0-0x0000000000F50000-0x000000000101A000-memory.dmp

    Filesize

    808KB

  • memory/2356-5-0x0000000005300000-0x000000000539E000-memory.dmp

    Filesize

    632KB

  • memory/2356-4-0x00000000003B0000-0x00000000003BC000-memory.dmp

    Filesize

    48KB

  • memory/2356-3-0x0000000000450000-0x000000000046A000-memory.dmp

    Filesize

    104KB

  • memory/2356-2-0x0000000000AD0000-0x0000000000B10000-memory.dmp

    Filesize

    256KB

  • memory/2356-1-0x0000000074AA0000-0x000000007518E000-memory.dmp

    Filesize

    6.9MB

  • memory/2604-41-0x0000000002970000-0x00000000029B0000-memory.dmp

    Filesize

    256KB

  • memory/2604-36-0x0000000002970000-0x00000000029B0000-memory.dmp

    Filesize

    256KB

  • memory/2604-43-0x000000006E570000-0x000000006EB1B000-memory.dmp

    Filesize

    5.7MB

  • memory/2604-34-0x000000006E570000-0x000000006EB1B000-memory.dmp

    Filesize

    5.7MB

  • memory/2604-39-0x0000000002970000-0x00000000029B0000-memory.dmp

    Filesize

    256KB

  • memory/2816-31-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2816-40-0x0000000074AA0000-0x000000007518E000-memory.dmp

    Filesize

    6.9MB

  • memory/2816-51-0x0000000074AA0000-0x000000007518E000-memory.dmp

    Filesize

    6.9MB

  • memory/2816-29-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2816-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2816-27-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2816-23-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2816-21-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2816-20-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2816-18-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB