Analysis

  • max time kernel
    163s
  • max time network
    178s
  • platform
    windows10-1703_x64
  • resource
    win10-20240319-en
  • resource tags

    arch:x64arch:x86image:win10-20240319-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12-04-2024 15:37

Errors

Reason
Machine shutdown

General

  • Target

    UzpnR6.exe

  • Size

    1.2MB

  • MD5

    75c50dbf2c70ea6ca170513f77168f58

  • SHA1

    512cc32329eaa9fcd4c6e507ef2a26823a06f1ac

  • SHA256

    ffcedb5228f316086a811d910fb0e423ef4d16878369b64808a44ccc8f23ae26

  • SHA512

    63eb2eb4f531ba9a3f4ac857e3aabef5cea925a04dbaa7010c2418bcafd0948e77cce3426b8ffb30d860e5e17add310ea6189a23ab180b36147bec193254d457

  • SSDEEP

    24576:7o/ynHkLXGxxGApcTVcIWcRf+r31bfd+v3A0IOhb:7atGxg+cZP32zJVkA0Isb

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

us1.localto.net:38905

Mutex

abf2fea6-bc08-449e-9ce0-142ecb0a54c5

Attributes
  • encryption_key

    93B883D530A44E5A4457CCB3F463B613FCE53505

  • install_name

    Google.exe.exe

  • log_directory

    Log

  • reconnect_delay

    3000

  • startup_key

    AntimaIware Core Service

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\UzpnR6.exe
    "C:\Users\Admin\AppData\Local\Temp\UzpnR6.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1916
    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
      "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4392
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "AntimaIware Core Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Google.exe.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4716
      • C:\Users\Admin\AppData\Roaming\SubDir\Google.exe.exe
        "C:\Users\Admin\AppData\Roaming\SubDir\Google.exe.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "AntimaIware Core Service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Google.exe.exe" /rl HIGHEST /f
          4⤵
          • Creates scheduled task(s)
          PID:4772
        • C:\Windows\System32\shutdown.exe
          "C:\Windows\System32\shutdown.exe" /s /t 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3336
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DisableAV.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t "REG_DWORD" /d "1" /f
        3⤵
          PID:3392
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0 /state0:0xa3ae9855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Client-built.exe

      Filesize

      3.1MB

      MD5

      383aa601a1a3e6722935b017a215f4b8

      SHA1

      3855b5d5ba3ba2f161bd6d60caac5415e93bd482

      SHA256

      6d03d6c26940eb9f2f6eaaa1d0a49d3f24a2941ec85bc7f12d3fb72162d780c8

      SHA512

      ceff9701a5cbc5bc6d61d5ebf0764b54aa056bdb311789f4dec7065a0910050932024498d0ee3a0a7f6b3cce2e5b77ff89d132120a4581536aa33822684f10eb

    • C:\Users\Admin\AppData\Local\Temp\DisableAV.bat

      Filesize

      119B

      MD5

      78645ad9e97d2b5f440e02959d9a1985

      SHA1

      63aae2a1e9a2a346a02faef58552449e25bfca0b

      SHA256

      83a149d70fcae8ce1bc42082383d09c98141673df509351294f40bb1cb77177d

      SHA512

      2b6141e0570fb1d44bf9fd5d7dff987ea97f46d58448d4549a5efb9876a9adb8c061c759fb9b0c6be68207df64633f5a7355949597aa5da2aac5a9b7d65de0bf

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xuww4rv3.fyc.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • memory/1916-8-0x0000013CD3990000-0x0000013CD39B2000-memory.dmp

      Filesize

      136KB

    • memory/1916-10-0x0000013CD3980000-0x0000013CD3990000-memory.dmp

      Filesize

      64KB

    • memory/1916-9-0x0000013CD3980000-0x0000013CD3990000-memory.dmp

      Filesize

      64KB

    • memory/1916-13-0x0000013CD3B40000-0x0000013CD3BB6000-memory.dmp

      Filesize

      472KB

    • memory/1916-7-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/1916-26-0x0000013CD3980000-0x0000013CD3990000-memory.dmp

      Filesize

      64KB

    • memory/1916-49-0x0000013CD3980000-0x0000013CD3990000-memory.dmp

      Filesize

      64KB

    • memory/1916-53-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4392-63-0x00000000004B0000-0x00000000007D4000-memory.dmp

      Filesize

      3.1MB

    • memory/4392-67-0x0000000000F60000-0x0000000000F70000-memory.dmp

      Filesize

      64KB

    • memory/4392-64-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4392-74-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4548-77-0x000000001BE80000-0x000000001BED0000-memory.dmp

      Filesize

      320KB

    • memory/4548-78-0x000000001BF90000-0x000000001C042000-memory.dmp

      Filesize

      712KB

    • memory/4548-93-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4548-88-0x00000000026A0000-0x00000000026B0000-memory.dmp

      Filesize

      64KB

    • memory/4548-75-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4548-76-0x00000000026A0000-0x00000000026B0000-memory.dmp

      Filesize

      64KB

    • memory/4548-87-0x00000000026A0000-0x00000000026B0000-memory.dmp

      Filesize

      64KB

    • memory/4548-86-0x00000000026A0000-0x00000000026B0000-memory.dmp

      Filesize

      64KB

    • memory/4548-79-0x000000001C780000-0x000000001CCA6000-memory.dmp

      Filesize

      5.1MB

    • memory/4548-82-0x000000001BF20000-0x000000001BF32000-memory.dmp

      Filesize

      72KB

    • memory/4548-83-0x000000001C250000-0x000000001C28E000-memory.dmp

      Filesize

      248KB

    • memory/4548-85-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4740-65-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4740-0-0x00000000002D0000-0x0000000000402000-memory.dmp

      Filesize

      1.2MB

    • memory/4740-1-0x00007FFD4E3B0000-0x00007FFD4ED9C000-memory.dmp

      Filesize

      9.9MB

    • memory/4740-2-0x000000001B580000-0x000000001B590000-memory.dmp

      Filesize

      64KB