Analysis

  • max time kernel
    32s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    18-04-2024 21:57

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    2c1fba8d6624adf6c582fb2d5fb43b28

  • SHA1

    bd45ee984e9476d604824f83c6cf6111a9db2467

  • SHA256

    a5473ea4c4ef75c217e0d252d1c7d235b781a75810b7e731a97ed78b45646840

  • SHA512

    cc85b5f1c2765c49f34c236634dcbfdfd6cc62e0b954b74c12b0d89dc29044dff88a9840e5c02a39e140564283074c78359dd70dfc7f426daefb75f195f14e19

  • SSDEEP

    49152:nvVG42pda6D+/PjlLOlg6yQipV6iRJ67bR3LoGdTqTHHB72eh2NT:nvM42pda6D+/PjlLOlZyQipV6iRJ6ND

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

funlink.ddns.net:4444

quasarhost1.ddns.net:4444

Mutex

c363b2f8-fc6a-4abd-a753-cff1aad2a173

Attributes
  • encryption_key

    CE5FBAC1A56C8C780C74FE8E7CD5CBCF8ABD6C8D

  • install_name

    updale.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    windows av startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:2372
    • C:\Windows\system32\SubDir\updale.exe
      "C:\Windows\system32\SubDir\updale.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:2656
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gr2I1MOKHAkw.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2692
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2824
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • Runs ping.exe
            PID:2480
          • C:\Windows\system32\SubDir\updale.exe
            "C:\Windows\system32\SubDir\updale.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
              5⤵
              • Creates scheduled task(s)
              PID:2972
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\FFtqHX0hE9Kn.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1592
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2776
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • Runs ping.exe
                  PID:2760
                • C:\Windows\system32\SubDir\updale.exe
                  "C:\Windows\system32\SubDir\updale.exe"
                  6⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2992
                  • C:\Windows\system32\schtasks.exe
                    "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
                    7⤵
                    • Creates scheduled task(s)
                    PID:852
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\jR2ZObGD7JDf.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1920
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:2872
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • Runs ping.exe
                        PID:2884
                      • C:\Windows\system32\SubDir\updale.exe
                        "C:\Windows\system32\SubDir\updale.exe"
                        8⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:2068
                        • C:\Windows\system32\schtasks.exe
                          "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
                          9⤵
                          • Creates scheduled task(s)
                          PID:480
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\Fn5vsx1QIngE.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1752
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:1104
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • Runs ping.exe
                              PID:2424
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            1⤵
              PID:2484

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\FFtqHX0hE9Kn.bat

              Filesize

              196B

              MD5

              370de616496f2ce55fe25cc0ec576a3b

              SHA1

              418a2d1f85a8c2b2a40e04eaab5ceccdac8b1215

              SHA256

              6759873dd19605915c91f604abdc375f1f82a02616d24ef061fd1b82e3db2273

              SHA512

              e577ad8ce9c080768b1685268530d383f00a56d52b847544b553919e0b50166d6309ee6bbb955892064f43c50b9df01328313e2d84d7b79fd52f635e79a03758

            • C:\Users\Admin\AppData\Local\Temp\Fn5vsx1QIngE.bat

              Filesize

              196B

              MD5

              8d5e164e2bc664938a4b6328f584f804

              SHA1

              38dd10f2de3a825b6f3543e68783b786323db4af

              SHA256

              ac1ea5cc8dfc8806181b3c9b44888fa660b592b75cb26fb4ee9a749daa933b15

              SHA512

              afa8f166b5bd1095f54ba84bbe0e87bc66b651b2ddcf6a9059eb331eccf2b6ad1745e794cf8fcc09e4b0b4c2e4268bcb1c05fcbe9132f30c3e242bf5a04c6f2e

            • C:\Users\Admin\AppData\Local\Temp\gr2I1MOKHAkw.bat

              Filesize

              196B

              MD5

              590d82d8e8a4f503e49fadea281133c6

              SHA1

              c0190faffb6983c8f801748d5adbb70d2ad56616

              SHA256

              4423a5abd96f27128398dd320ca43c9ce8ce69c461d07e4efd1d7b8f410f57a2

              SHA512

              bcc76d9980b3e8cd49e5f8984b65848b75e16977281ef8427e76dc9b65df81f24442848b96a1c91ec4dcae2c5e241573eb6f4c504f71ec8b08fa0af4edebdcd5

            • C:\Users\Admin\AppData\Local\Temp\jR2ZObGD7JDf.bat

              Filesize

              196B

              MD5

              c14ac3ea67dd5970c2221cd5d5ce5803

              SHA1

              9e29cde296d25436f1127ec66d8b5cba1955f93c

              SHA256

              ebeca62a9ca902e0cf69fecc604134d511910aaf4ed471fe78aeb87831fb0cd8

              SHA512

              d624e0c5e7385d6155cd028d4cdea4f38b817adf88a6df95d2387a603dc3eb9ef47a5eba7590bb7ba7117116eb6e0103f83a2092bc9952eda084373fc7e7bfdf

            • C:\Windows\System32\SubDir\updale.exe

              Filesize

              3.1MB

              MD5

              2c1fba8d6624adf6c582fb2d5fb43b28

              SHA1

              bd45ee984e9476d604824f83c6cf6111a9db2467

              SHA256

              a5473ea4c4ef75c217e0d252d1c7d235b781a75810b7e731a97ed78b45646840

              SHA512

              cc85b5f1c2765c49f34c236634dcbfdfd6cc62e0b954b74c12b0d89dc29044dff88a9840e5c02a39e140564283074c78359dd70dfc7f426daefb75f195f14e19

            • \??\PIPE\lsarpc

              MD5

              d41d8cd98f00b204e9800998ecf8427e

              SHA1

              da39a3ee5e6b4b0d3255bfef95601890afd80709

              SHA256

              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

              SHA512

              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

            • memory/764-0-0x0000000001140000-0x0000000001464000-memory.dmp

              Filesize

              3.1MB

            • memory/764-8-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

              Filesize

              9.9MB

            • memory/764-1-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

              Filesize

              9.9MB

            • memory/764-2-0x000000001B2C0000-0x000000001B340000-memory.dmp

              Filesize

              512KB

            • memory/1948-11-0x000000001AF60000-0x000000001AFE0000-memory.dmp

              Filesize

              512KB

            • memory/1948-20-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

              Filesize

              9.9MB

            • memory/1948-10-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

              Filesize

              9.9MB

            • memory/1948-9-0x0000000001120000-0x0000000001444000-memory.dmp

              Filesize

              3.1MB

            • memory/2068-61-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

              Filesize

              9.9MB

            • memory/2068-51-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

              Filesize

              9.9MB

            • memory/2452-23-0x00000000013D0000-0x00000000016F4000-memory.dmp

              Filesize

              3.1MB

            • memory/2452-35-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

              Filesize

              9.9MB

            • memory/2452-25-0x000000001B470000-0x000000001B4F0000-memory.dmp

              Filesize

              512KB

            • memory/2452-24-0x000007FEF52F0000-0x000007FEF5CDC000-memory.dmp

              Filesize

              9.9MB

            • memory/2992-39-0x000000001AFA0000-0x000000001B020000-memory.dmp

              Filesize

              512KB

            • memory/2992-38-0x000007FEF50E0000-0x000007FEF5ACC000-memory.dmp

              Filesize

              9.9MB

            • memory/2992-49-0x000007FEF50E0000-0x000007FEF5ACC000-memory.dmp

              Filesize

              9.9MB