Analysis
-
max time kernel
1s -
max time network
88s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 23:27
Behavioral task
behavioral1
Sample
ccad408c7ce69d5e4f2d635c46458202.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccad408c7ce69d5e4f2d635c46458202.exe
Resource
win10v2004-20240226-en
General
-
Target
ccad408c7ce69d5e4f2d635c46458202.exe
-
Size
2.0MB
-
MD5
ccad408c7ce69d5e4f2d635c46458202
-
SHA1
0c9e336b44a67d65843311bfe8711cd32b965c8c
-
SHA256
818d900af1ef03e94a077f06e6531278ee35f2510439922b8f583e7abb7094f7
-
SHA512
be40f01f9a7d5dfa5967a20d82cb509075be95e4cba0fc69119c7d252a110c4e34e0988a4418243df8afef7642c65d9f4b7f11aaf640941670a2621a00fa8707
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYO:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y0
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral1/memory/2612-55-0x0000000001030000-0x000000000108E000-memory.dmp family_quasar behavioral1/memory/2872-65-0x0000000000AA0000-0x0000000000AFE000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
vnc.exepid process 2740 vnc.exe -
Loads dropped DLL 4 IoCs
Processes:
ccad408c7ce69d5e4f2d635c46458202.exepid process 1732 ccad408c7ce69d5e4f2d635c46458202.exe 1732 ccad408c7ce69d5e4f2d635c46458202.exe 1732 ccad408c7ce69d5e4f2d635c46458202.exe 1732 ccad408c7ce69d5e4f2d635c46458202.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2304 2872 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2520 schtasks.exe 2508 schtasks.exe 2244 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ccad408c7ce69d5e4f2d635c46458202.exepid process 1732 ccad408c7ce69d5e4f2d635c46458202.exe 1732 ccad408c7ce69d5e4f2d635c46458202.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ccad408c7ce69d5e4f2d635c46458202.exevnc.exedescription pid process target process PID 1732 wrote to memory of 2740 1732 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 1732 wrote to memory of 2740 1732 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 1732 wrote to memory of 2740 1732 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 1732 wrote to memory of 2740 1732 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 2740 wrote to memory of 2564 2740 vnc.exe svchost.exe PID 2740 wrote to memory of 2564 2740 vnc.exe svchost.exe PID 2740 wrote to memory of 2564 2740 vnc.exe svchost.exe PID 2740 wrote to memory of 2564 2740 vnc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\glmsgQ1LZOtH.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 14964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\glmsgQ1LZOtH.batFilesize
208B
MD5736c757d0363accc8291efeef5685c74
SHA163a0bf54d10bcaa80a6886ba174545ac51bcc419
SHA25666d3ced082611a32b749df34b3967a403a6c3ee6e914fbad315b3ae8550383d2
SHA512edd7b2cb4c952e34b9f243605695fdaf145e8b60df2f2d8ce96c68d84ee350ce089aaff7d845a9f827282ac53bc46b194a1438b2c02a7fafa2ca9613d6d42ade
-
\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
memory/1732-31-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/1732-69-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/1792-89-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/1792-88-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/2564-34-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2564-38-0x000007FFFFFD6000-0x000007FFFFFD7000-memory.dmpFilesize
4KB
-
memory/2564-40-0x0000000000020000-0x0000000000021000-memory.dmpFilesize
4KB
-
memory/2564-43-0x00000000003F0000-0x000000000048C000-memory.dmpFilesize
624KB
-
memory/2564-70-0x00000000003F0000-0x000000000048C000-memory.dmpFilesize
624KB
-
memory/2612-55-0x0000000001030000-0x000000000108E000-memory.dmpFilesize
376KB
-
memory/2612-56-0x0000000004810000-0x0000000004850000-memory.dmpFilesize
256KB
-
memory/2612-64-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/2612-54-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/2632-46-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2632-51-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2632-30-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2632-32-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2872-65-0x0000000000AA0000-0x0000000000AFE000-memory.dmpFilesize
376KB
-
memory/2872-66-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/2872-67-0x0000000000410000-0x0000000000450000-memory.dmpFilesize
256KB
-
memory/2872-71-0x0000000074700000-0x0000000074DEE000-memory.dmpFilesize
6.9MB
-
memory/2872-72-0x0000000000410000-0x0000000000450000-memory.dmpFilesize
256KB