Analysis

  • max time kernel
    128s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-04-2024 22:39

General

  • Target

    579ebb1309ad953fa0cb52c33b190baa.exe

  • Size

    786KB

  • MD5

    579ebb1309ad953fa0cb52c33b190baa

  • SHA1

    70ccb8c950d96a7e6c32d09c307227f271a627ba

  • SHA256

    54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781

  • SHA512

    2b9d5413626358fae10013e2fd214ec5e66cf7c30665f896563a39f3564ef475cbda8de14cb6f9260d5f49b70a1967d1097c0f855e7985ebed78d2a0c25390d4

  • SSDEEP

    24576:6O7r0f+STf0QcR9CTsPsOcs1kITzH9FHB2PpO:6gAf+YMQceTs1t1/TzdFh20

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

83.147.53.145:3700

Mutex

QSR_MUTEX_6WQThXDTXhAO4iLfWV

Attributes
  • encryption_key

    rylGzNSu4oGtwQbffX0U

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
    "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3964
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YXiUvROAyTyYWN.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5012
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YXiUvROAyTyYWN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6561.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4776
    • C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
      "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
      2⤵
        PID:3212
      • C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe
        "C:\Users\Admin\AppData\Local\Temp\579ebb1309ad953fa0cb52c33b190baa.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:216
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4748
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YXiUvROAyTyYWN.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4624
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YXiUvROAyTyYWN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9CBD.tmp"
            4⤵
            • Creates scheduled task(s)
            PID:5020
          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1976

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\579ebb1309ad953fa0cb52c33b190baa.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      cd48552ac250ebfe93447bc75ccfe442

      SHA1

      03b5823247ec794a61580a8115ee74fec241f28f

      SHA256

      c0281e0db8d67007e1e51e94a391c2f7a3f746e94ef2646a05d0160bf9196fbc

      SHA512

      a57d0f1b26d53ce67ad6fdcd683b8f2e4d4e1abfd455a33f765d1a18af77f0d47b1af37b8405e2d5b9658b706984587ded79e94172178f8fe279b0d9cdfe4295

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      a8dc1f6fa23f660eab56064627925ae5

      SHA1

      1f68e86745fe006912ac9a76ec10bfd251dcccc9

      SHA256

      e8354eb3d3ca747f53a7ed832fa4a7810413a93c379c25d6b4ddf9aeb6cafe87

      SHA512

      ef049cbce2294b4cdab535245e7f9ec1d4e69b04736e9197bfeeb6179b13653bbf32bed29b1f2c3a9dc12e708e6b6041a60d4f3d41e5dc62d667bf6dd4eb1559

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avvdzaap.n5z.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmp6561.tmp

      Filesize

      1KB

      MD5

      03ed54d29052e596b4598f41cacbe969

      SHA1

      0cf8a0e23862e6905ba6d71c82748846d267a9b4

      SHA256

      fefdc4e55a41f64c28ce0f2a206d7967130198dabc2066abe042cf52f17b5637

      SHA512

      a04892a880d2cf3a805065e2857f8fbf3af1dd8a9f06ac5d247193c24953420de24bab1f24ef23516ca7ae9646cc8441f7522cb1a2b8575891a554fd420d29c2

    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

      Filesize

      786KB

      MD5

      579ebb1309ad953fa0cb52c33b190baa

      SHA1

      70ccb8c950d96a7e6c32d09c307227f271a627ba

      SHA256

      54d2d49ad4366ffc67625a32754dee1d802c2780de2fd8d1d3c9609c0f584781

      SHA512

      2b9d5413626358fae10013e2fd214ec5e66cf7c30665f896563a39f3564ef475cbda8de14cb6f9260d5f49b70a1967d1097c0f855e7985ebed78d2a0c25390d4

    • memory/216-90-0x0000000005620000-0x0000000005630000-memory.dmp

      Filesize

      64KB

    • memory/216-137-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/216-89-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/1976-136-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3132-8-0x0000000006670000-0x000000000670E000-memory.dmp

      Filesize

      632KB

    • memory/3132-3-0x0000000005280000-0x0000000005312000-memory.dmp

      Filesize

      584KB

    • memory/3132-2-0x0000000005830000-0x0000000005DD4000-memory.dmp

      Filesize

      5.6MB

    • memory/3132-1-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3132-9-0x0000000008F80000-0x000000000901C000-memory.dmp

      Filesize

      624KB

    • memory/3132-20-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3132-4-0x00000000051B0000-0x00000000051C0000-memory.dmp

      Filesize

      64KB

    • memory/3132-7-0x0000000006400000-0x000000000640C000-memory.dmp

      Filesize

      48KB

    • memory/3132-0-0x00000000008A0000-0x000000000096A000-memory.dmp

      Filesize

      808KB

    • memory/3132-6-0x0000000006860000-0x000000000687A000-memory.dmp

      Filesize

      104KB

    • memory/3132-49-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3132-5-0x0000000005220000-0x000000000522A000-memory.dmp

      Filesize

      40KB

    • memory/3964-17-0x0000000005050000-0x0000000005678000-memory.dmp

      Filesize

      6.2MB

    • memory/3964-88-0x0000000002630000-0x0000000002640000-memory.dmp

      Filesize

      64KB

    • memory/3964-96-0x00000000074E0000-0x00000000074EE000-memory.dmp

      Filesize

      56KB

    • memory/3964-14-0x00000000049E0000-0x0000000004A16000-memory.dmp

      Filesize

      216KB

    • memory/3964-25-0x0000000005790000-0x00000000057F6000-memory.dmp

      Filesize

      408KB

    • memory/3964-94-0x0000000007530000-0x00000000075C6000-memory.dmp

      Filesize

      600KB

    • memory/3964-51-0x0000000005F80000-0x0000000005F9E000-memory.dmp

      Filesize

      120KB

    • memory/3964-52-0x0000000006030000-0x000000000607C000-memory.dmp

      Filesize

      304KB

    • memory/3964-105-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3964-16-0x0000000002630000-0x0000000002640000-memory.dmp

      Filesize

      64KB

    • memory/3964-15-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3964-26-0x0000000005950000-0x00000000059B6000-memory.dmp

      Filesize

      408KB

    • memory/3964-73-0x0000000075150000-0x000000007519C000-memory.dmp

      Filesize

      304KB

    • memory/3964-86-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3964-18-0x0000000002630000-0x0000000002640000-memory.dmp

      Filesize

      64KB

    • memory/3964-23-0x00000000056F0000-0x0000000005712000-memory.dmp

      Filesize

      136KB

    • memory/3964-70-0x000000007EFD0000-0x000000007EFE0000-memory.dmp

      Filesize

      64KB

    • memory/3988-53-0x0000000005CF0000-0x0000000005D02000-memory.dmp

      Filesize

      72KB

    • memory/3988-87-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3988-67-0x0000000006370000-0x00000000063AC000-memory.dmp

      Filesize

      240KB

    • memory/3988-46-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3988-48-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/3988-50-0x0000000004F80000-0x0000000004F90000-memory.dmp

      Filesize

      64KB

    • memory/4624-113-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/4624-123-0x0000000000B40000-0x0000000000B50000-memory.dmp

      Filesize

      64KB

    • memory/4748-140-0x000000007F800000-0x000000007F810000-memory.dmp

      Filesize

      64KB

    • memory/4748-108-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/4748-109-0x00000000045F0000-0x0000000004600000-memory.dmp

      Filesize

      64KB

    • memory/4748-139-0x0000000005C10000-0x0000000005C5C000-memory.dmp

      Filesize

      304KB

    • memory/4748-110-0x00000000045F0000-0x0000000004600000-memory.dmp

      Filesize

      64KB

    • memory/4748-112-0x00000000054B0000-0x0000000005804000-memory.dmp

      Filesize

      3.3MB

    • memory/5012-66-0x00000000071E0000-0x00000000071FE000-memory.dmp

      Filesize

      120KB

    • memory/5012-99-0x00000000078D0000-0x00000000078D8000-memory.dmp

      Filesize

      32KB

    • memory/5012-98-0x00000000078F0000-0x000000000790A000-memory.dmp

      Filesize

      104KB

    • memory/5012-97-0x00000000077F0000-0x0000000007804000-memory.dmp

      Filesize

      80KB

    • memory/5012-95-0x00000000077B0000-0x00000000077C1000-memory.dmp

      Filesize

      68KB

    • memory/5012-93-0x0000000007620000-0x000000000762A000-memory.dmp

      Filesize

      40KB

    • memory/5012-106-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB

    • memory/5012-92-0x00000000075B0000-0x00000000075CA000-memory.dmp

      Filesize

      104KB

    • memory/5012-91-0x0000000007BF0000-0x000000000826A000-memory.dmp

      Filesize

      6.5MB

    • memory/5012-69-0x0000000007450000-0x00000000074F3000-memory.dmp

      Filesize

      652KB

    • memory/5012-68-0x0000000004DF0000-0x0000000004E00000-memory.dmp

      Filesize

      64KB

    • memory/5012-55-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

      Filesize

      64KB

    • memory/5012-56-0x0000000075150000-0x000000007519C000-memory.dmp

      Filesize

      304KB

    • memory/5012-54-0x0000000007200000-0x0000000007232000-memory.dmp

      Filesize

      200KB

    • memory/5012-45-0x0000000005DB0000-0x0000000006104000-memory.dmp

      Filesize

      3.3MB

    • memory/5012-21-0x0000000004DF0000-0x0000000004E00000-memory.dmp

      Filesize

      64KB

    • memory/5012-24-0x0000000004DF0000-0x0000000004E00000-memory.dmp

      Filesize

      64KB

    • memory/5012-19-0x00000000748A0000-0x0000000075050000-memory.dmp

      Filesize

      7.7MB