Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-04-2024 01:57

General

  • Target

    d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833.exe

  • Size

    3.1MB

  • MD5

    3396e77d0d043554c7f857a1249c75fe

  • SHA1

    d3de2678e85f4ad63e5254782a58a85035aafecc

  • SHA256

    d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

  • SHA512

    3128c03a0465d03127cf6df186533993e2337dce8ca821d8dbcaecd08c7ff7a6d2646de150b7afbe20641e4eb08104342813dfd2fe50346c8b47d40deedc67a4

  • SSDEEP

    49152:WvnG42pda6D+/PjlLOlg6yQipV7tjMpETOk/FLoGd7RTHHB72eh2NT:WvG42pda6D+/PjlLOlZyQipVhj9

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.10.8.36:4782

0.tcp.eu.ngrok.io:19992

tcp://5.tcp.eu.ngrok.io:10477

Mutex

570f8f63-dc8c-471b-b7f5-710ac819d722

Attributes
  • encryption_key

    BB0B2DE4F1126E98797D1ABADF2CCEC47E72B5FD

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    150

  • startup_key

    Platonus

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 2 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
  • Detects executables containing common artifacts observed in infostealers 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833.exe
    "C:\Users\Admin\AppData\Local\Temp\d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Platonus" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:1760
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Platonus" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P29wcDMzS7DL.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:1200
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:436
          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2656
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "Platonus" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
              5⤵
              • Creates scheduled task(s)
              PID:4884
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cMD3IV4Ps0W2.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3444
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:3864
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:1972
                • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2040
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "Platonus" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                    7⤵
                    • Creates scheduled task(s)
                    PID:3388
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hRX0ROMF8Zwb.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3376
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:988
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:4524
                      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3116
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "Platonus" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                          9⤵
                          • Creates scheduled task(s)
                          PID:3836
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ujlL4gxfCVPw.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4880
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:4652
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:3372
                            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                              10⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3920
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks" /create /tn "Platonus" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                                11⤵
                                • Creates scheduled task(s)
                                PID:3192

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

            Filesize

            2KB

            MD5

            8f0271a63446aef01cf2bfc7b7c7976b

            SHA1

            b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

            SHA256

            da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

            SHA512

            78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

          • C:\Users\Admin\AppData\Local\Temp\P29wcDMzS7DL.bat

            Filesize

            207B

            MD5

            0314432a628bbd8d833674f5526dc427

            SHA1

            c2ce0b0d4b6cdeb35cededbfbe73d873a774403e

            SHA256

            4125434c5b7fd433c387025ac3ca85bcedd32b587895013aae8dc8cf8f68048d

            SHA512

            142a47003c1580631785b6e00da0230beb0db0dd6202b062b6edfa3cf10b6b79c9782cb144c402c211726ba627b89bc5468a05ee3e45384e8ae5710ab930e224

          • C:\Users\Admin\AppData\Local\Temp\cMD3IV4Ps0W2.bat

            Filesize

            207B

            MD5

            e5d018107b44b3197157b04916915391

            SHA1

            33da08313fe9221e24eb812c6b5ed7dfa5f4ff5b

            SHA256

            b09c96eaadcf20ce9590d403e9e63c753e4007e24df6bd843c58723e41bd9cd4

            SHA512

            ee4af0dbe6c60933bfe84737f9361e9a7c5635f36f2a07e340afc39aa500ecf36554569de2d20073a7709d95cd4686d595ecdb7859eb8332a0aff04cd47cf173

          • C:\Users\Admin\AppData\Local\Temp\hRX0ROMF8Zwb.bat

            Filesize

            207B

            MD5

            1c085d0b55fc1f77f875141850a73123

            SHA1

            3f6ed98606ebae3dd5ce0d9de8fbd76a5f8a2826

            SHA256

            9d2f5f0791a6f05cee240a6ed1b4e24ccb051256eea9911c6552452142bb4f82

            SHA512

            2e7f0430b55cb9e650c2b1fba5eb8945a38987557cdc5adf139b00bbe9e3081e5931181110bf6d15b61c5a46aabc4c1f11e4aacd75b7b5a163510618f3f67d6d

          • C:\Users\Admin\AppData\Local\Temp\ujlL4gxfCVPw.bat

            Filesize

            207B

            MD5

            0704a04d52602dd7ed66fde1ea8fda8b

            SHA1

            e67d0339c75e3d774bcdc8403236e980e25e326c

            SHA256

            223335bb67662945fecd70de2ccf2061a723e51e5a2aab0e270e114716dcf55a

            SHA512

            e192188a05a8caf69eef810a9c2c53bf7272289a083aaa65191e93557e5d52b2f6503abf7b2599f7db47cb947f6c47b820dab4322b35dc8f74cbf95f3268789c

          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

            Filesize

            3.1MB

            MD5

            3396e77d0d043554c7f857a1249c75fe

            SHA1

            d3de2678e85f4ad63e5254782a58a85035aafecc

            SHA256

            d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

            SHA512

            3128c03a0465d03127cf6df186533993e2337dce8ca821d8dbcaecd08c7ff7a6d2646de150b7afbe20641e4eb08104342813dfd2fe50346c8b47d40deedc67a4

          • memory/216-10-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/216-11-0x000000001B8B0000-0x000000001B8C0000-memory.dmp

            Filesize

            64KB

          • memory/216-12-0x000000001DEC0000-0x000000001DF10000-memory.dmp

            Filesize

            320KB

          • memory/216-13-0x000000001DFD0000-0x000000001E082000-memory.dmp

            Filesize

            712KB

          • memory/216-14-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/216-19-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2040-38-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2040-33-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2040-34-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2656-26-0x000000001BB00000-0x000000001BB10000-memory.dmp

            Filesize

            64KB

          • memory/2656-23-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2656-31-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2656-25-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/2656-24-0x000000001BB00000-0x000000001BB10000-memory.dmp

            Filesize

            64KB

          • memory/3116-48-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/3116-41-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/3116-42-0x0000000001100000-0x0000000001110000-memory.dmp

            Filesize

            64KB

          • memory/3116-43-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/3116-44-0x0000000001100000-0x0000000001110000-memory.dmp

            Filesize

            64KB

          • memory/3920-52-0x0000000002D20000-0x0000000002D30000-memory.dmp

            Filesize

            64KB

          • memory/3920-51-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/4168-9-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/4168-1-0x00007FFF986A0000-0x00007FFF99161000-memory.dmp

            Filesize

            10.8MB

          • memory/4168-2-0x000000001B8A0000-0x000000001B8B0000-memory.dmp

            Filesize

            64KB

          • memory/4168-0-0x00000000008C0000-0x0000000000BE4000-memory.dmp

            Filesize

            3.1MB