Analysis
-
max time kernel
128s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 10:42
Behavioral task
behavioral1
Sample
ratXD.exe
Resource
win7-20240221-en
General
-
Target
ratXD.exe
-
Size
3.1MB
-
MD5
9c5f2f586e52a975593d11710685f846
-
SHA1
887006a6849b22cfbf85871e50ab33404097f654
-
SHA256
9259a4e7b71dc408f62faa9c6f7f73b5a906466dc9c751bfa8b23f641cc614f2
-
SHA512
c3fb61664de1248713b7c1a98d17b344a68d6a676841f174659565e043ec6aecc0c27bd4a47d815e0d19fd070054ff2ca57fb304878b284162a5b9142c2b38bf
-
SSDEEP
49152:avCI22SsaNYfdPBldt698dBcjHBY5VBxFUoGdD9THHB72eh2NT:avP22SsaNYfdPBldt6+dBcjHBY5c
Malware Config
Extracted
quasar
1.4.1
Office04
177.72.82.9:5678
62a700ff-4fdb-4af6-b871-ab8a290f0701
-
encryption_key
E0A41577673498A6E2FD27CB9AED2F6B83527072
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
quasar
-
reconnect_delay
3000
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-0-0x00000000012F0000-0x0000000001614000-memory.dmp family_quasar behavioral1/memory/2080-9-0x0000000001300000-0x0000000001624000-memory.dmp family_quasar C:\Windows\system32\SubDir\Client.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 2080 Client.exe -
Drops file in System32 directory 2 IoCs
Processes:
ratXD.exedescription ioc process File created C:\Windows\system32\SubDir\Client.exe ratXD.exe File opened for modification C:\Windows\system32\SubDir\Client.exe ratXD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ratXD.exeClient.exedescription pid process Token: SeDebugPrivilege 2172 ratXD.exe Token: SeDebugPrivilege 2080 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Client.exepid process 2080 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Client.exepid process 2080 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 2080 Client.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ratXD.exedescription pid process target process PID 2172 wrote to memory of 2080 2172 ratXD.exe Client.exe PID 2172 wrote to memory of 2080 2172 ratXD.exe Client.exe PID 2172 wrote to memory of 2080 2172 ratXD.exe Client.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratXD.exe"C:\Users\Admin\AppData\Local\Temp\ratXD.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\SubDir\Client.exe"C:\Windows\system32\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD504111705ab65d5bc16adf4eeab90011c
SHA197442c8671032c8e6bdf1bb086c4557efe40cb9e
SHA2566705d825bcee1ee4f759c0d8908042516c5871a7dffa00d9adcba15f991e5162
SHA512eddcab5dcc76831dc55438c2748d4caf2baba711b3042f7c9e27ff49015cd04bd805ff7f1f4c598b90de4ec2796eff2649dc949cdbe491bea40f3f0d8a1d6c1b