Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-04-2024 01:09

General

  • Target

    28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6.exe

  • Size

    3.5MB

  • MD5

    af1082c667a09a0f1f6adb041ca37d34

  • SHA1

    ccb770b00596a1d2fa0d9d7d3dbe9451734a30f9

  • SHA256

    28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6

  • SHA512

    4d1c50b42077ec0a8f0060410e75201e920b951f299e8d9a247fb4ba3c920ef5d16f7b30e2decef5323d88e28e3daeee60ae3fcd1e00de36e0185336b1582404

  • SSDEEP

    98304:p99xyD6/xKyfNf6wZsi/0+zqEsf+JQgWq:rXIc7fNf6Y4EsWxR

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

157.20.182.46:4782

Mutex

a5764ae9-1c39-4533-95ca-a5d90dae860a

Attributes
  • encryption_key

    BA20F732417E96C201B42F315FAD6CF773D77589

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6.exe
    "C:\Users\Admin\AppData\Local\Temp\28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:4772
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCCE5.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3456
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • UAC bypass
        • Windows security bypass
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Maps connected drives based on registry
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3632
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3372
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
          4⤵
            PID:1104
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1540
            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
              5⤵
              • Executes dropped EXE
              PID:5044

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    3
    T1562

    Disable or Modify Tools

    3
    T1562.001

    Modify Registry

    5
    T1112

    Virtualization/Sandbox Evasion

    2
    T1497

    Discovery

    Query Registry

    6
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    5
    T1082

    Peripheral Device Discovery

    1
    T1120

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_amiqo2uv.ocu.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpCCE5.tmp.bat
      Filesize

      151B

      MD5

      cc310f6b48a9e21967fad79144986a56

      SHA1

      fcac38ee13329fcbba6141043e2795b88d746f0d

      SHA256

      2ee51520c9140103bfe161a1dec9cc205f34127df8f07effaf54e78b88f537eb

      SHA512

      3b05964c70799b1a0543773b0d796b95fa58b203a6ff1a3e02aa23a464b6c192e1c5f04ba1e2d664eb2d7d190e7059def675383711a77cffb7c17bbbfef42398

    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      Filesize

      41KB

      MD5

      5d4073b2eb6d217c19f2b22f21bf8d57

      SHA1

      f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

      SHA256

      ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

      SHA512

      9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      3.5MB

      MD5

      af1082c667a09a0f1f6adb041ca37d34

      SHA1

      ccb770b00596a1d2fa0d9d7d3dbe9451734a30f9

      SHA256

      28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6

      SHA512

      4d1c50b42077ec0a8f0060410e75201e920b951f299e8d9a247fb4ba3c920ef5d16f7b30e2decef5323d88e28e3daeee60ae3fcd1e00de36e0185336b1582404

    • memory/1540-29-0x0000000005B30000-0x00000000060D4000-memory.dmp
      Filesize

      5.6MB

    • memory/1540-27-0x0000000000400000-0x0000000000724000-memory.dmp
      Filesize

      3.1MB

    • memory/1540-45-0x0000000075100000-0x00000000758B0000-memory.dmp
      Filesize

      7.7MB

    • memory/1540-35-0x0000000005540000-0x000000000554A000-memory.dmp
      Filesize

      40KB

    • memory/1540-34-0x0000000005660000-0x0000000005670000-memory.dmp
      Filesize

      64KB

    • memory/1540-30-0x0000000005580000-0x0000000005612000-memory.dmp
      Filesize

      584KB

    • memory/1540-28-0x0000000075100000-0x00000000758B0000-memory.dmp
      Filesize

      7.7MB

    • memory/3372-15-0x000002244F2F0000-0x000002244F300000-memory.dmp
      Filesize

      64KB

    • memory/3372-16-0x000002244F2F0000-0x000002244F300000-memory.dmp
      Filesize

      64KB

    • memory/3372-26-0x0000022467A60000-0x0000022467A82000-memory.dmp
      Filesize

      136KB

    • memory/3372-14-0x00007FFD01CA0000-0x00007FFD02761000-memory.dmp
      Filesize

      10.8MB

    • memory/3372-33-0x00007FFD01CA0000-0x00007FFD02761000-memory.dmp
      Filesize

      10.8MB

    • memory/3632-36-0x00007FFD01CA0000-0x00007FFD02761000-memory.dmp
      Filesize

      10.8MB

    • memory/3632-13-0x00007FFD01CA0000-0x00007FFD02761000-memory.dmp
      Filesize

      10.8MB

    • memory/4472-8-0x00007FFD02230000-0x00007FFD02CF1000-memory.dmp
      Filesize

      10.8MB

    • memory/4472-0-0x000001E795D40000-0x000001E795D48000-memory.dmp
      Filesize

      32KB

    • memory/4472-2-0x000001E7978C0000-0x000001E7978D0000-memory.dmp
      Filesize

      64KB

    • memory/4472-1-0x00007FFD02230000-0x00007FFD02CF1000-memory.dmp
      Filesize

      10.8MB

    • memory/4472-3-0x000001E7B01D0000-0x000001E7B0548000-memory.dmp
      Filesize

      3.5MB

    • memory/5044-43-0x0000000000270000-0x000000000027C000-memory.dmp
      Filesize

      48KB

    • memory/5044-44-0x0000000075100000-0x00000000758B0000-memory.dmp
      Filesize

      7.7MB

    • memory/5044-46-0x0000000004A40000-0x0000000004A5A000-memory.dmp
      Filesize

      104KB

    • memory/5044-48-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
      Filesize

      64KB

    • memory/5044-49-0x0000000075100000-0x00000000758B0000-memory.dmp
      Filesize

      7.7MB