Analysis

  • max time kernel
    142s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-04-2024 05:45

General

  • Target

    krummy-lavacrypt-gfhd.exe

  • Size

    3.5MB

  • MD5

    af1082c667a09a0f1f6adb041ca37d34

  • SHA1

    ccb770b00596a1d2fa0d9d7d3dbe9451734a30f9

  • SHA256

    28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6

  • SHA512

    4d1c50b42077ec0a8f0060410e75201e920b951f299e8d9a247fb4ba3c920ef5d16f7b30e2decef5323d88e28e3daeee60ae3fcd1e00de36e0185336b1582404

  • SSDEEP

    98304:p99xyD6/xKyfNf6wZsi/0+zqEsf+JQgWq:rXIc7fNf6Y4EsWxR

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

157.20.182.46:4782

Mutex

a5764ae9-1c39-4533-95ca-a5d90dae860a

Attributes
  • encryption_key

    BA20F732417E96C201B42F315FAD6CF773D77589

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\krummy-lavacrypt-gfhd.exe
    "C:\Users\Admin\AppData\Local\Temp\krummy-lavacrypt-gfhd.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4460
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:4480
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF898.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4608
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • UAC bypass
        • Windows security bypass
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Maps connected drives based on registry
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1468
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
            5⤵
            • Executes dropped EXE
            PID:2860
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
          4⤵
            PID:4756
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:404

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Execution

      Scheduled Task/Job

      1
      T1053

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      3
      T1562

      Disable or Modify Tools

      3
      T1562.001

      Modify Registry

      5
      T1112

      Virtualization/Sandbox Evasion

      2
      T1497

      Discovery

      Query Registry

      6
      T1012

      Virtualization/Sandbox Evasion

      2
      T1497

      System Information Discovery

      5
      T1082

      Peripheral Device Discovery

      1
      T1120

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xec2jyvk.cyr.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmpF898.tmp.bat
        Filesize

        151B

        MD5

        c4d378da0638c70e7cdb260046cb3dd6

        SHA1

        9a3b63e09e4da7c2885b84934ff1deaac42efabe

        SHA256

        0e96d33c53da430773e89f66eb5bc1b17aef4770dbf47ac86a600a6af6c3a9f6

        SHA512

        4b18ec8fd75aebccb23c1b650f7403ebc0e3ece531c62cff543ecd907f44f1678fa4993ddf7e68a703e5c3eebe00b3d1a8bf885b6f5945b442f976840bed9203

      • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        Filesize

        46KB

        MD5

        94c8e57a80dfca2482dedb87b93d4fd9

        SHA1

        5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

        SHA256

        39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

        SHA512

        1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

      • C:\Users\Admin\AppData\Roaming\svchost.exe
        Filesize

        3.5MB

        MD5

        af1082c667a09a0f1f6adb041ca37d34

        SHA1

        ccb770b00596a1d2fa0d9d7d3dbe9451734a30f9

        SHA256

        28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6

        SHA512

        4d1c50b42077ec0a8f0060410e75201e920b951f299e8d9a247fb4ba3c920ef5d16f7b30e2decef5323d88e28e3daeee60ae3fcd1e00de36e0185336b1582404

      • memory/772-1-0x00007FFE8AC00000-0x00007FFE8B6C1000-memory.dmp
        Filesize

        10.8MB

      • memory/772-2-0x000001ADE6410000-0x000001ADE6420000-memory.dmp
        Filesize

        64KB

      • memory/772-3-0x000001ADE6420000-0x000001ADE6798000-memory.dmp
        Filesize

        3.5MB

      • memory/772-8-0x00007FFE8AC00000-0x00007FFE8B6C1000-memory.dmp
        Filesize

        10.8MB

      • memory/772-0-0x000001ADCBE00000-0x000001ADCBE08000-memory.dmp
        Filesize

        32KB

      • memory/1468-14-0x000001FA33E20000-0x000001FA33E42000-memory.dmp
        Filesize

        136KB

      • memory/1468-16-0x000001FA4C280000-0x000001FA4C290000-memory.dmp
        Filesize

        64KB

      • memory/1468-15-0x00007FFE8ACB0000-0x00007FFE8B771000-memory.dmp
        Filesize

        10.8MB

      • memory/1468-26-0x000001FA4C280000-0x000001FA4C290000-memory.dmp
        Filesize

        64KB

      • memory/1468-27-0x000001FA4C280000-0x000001FA4C290000-memory.dmp
        Filesize

        64KB

      • memory/1468-32-0x00007FFE8ACB0000-0x00007FFE8B771000-memory.dmp
        Filesize

        10.8MB

      • memory/1468-29-0x000001FA4C280000-0x000001FA4C290000-memory.dmp
        Filesize

        64KB

      • memory/2152-37-0x0000000005860000-0x0000000005870000-memory.dmp
        Filesize

        64KB

      • memory/2152-33-0x0000000074FA0000-0x0000000075750000-memory.dmp
        Filesize

        7.7MB

      • memory/2152-34-0x0000000005D80000-0x0000000006324000-memory.dmp
        Filesize

        5.6MB

      • memory/2152-35-0x0000000005910000-0x00000000059A2000-memory.dmp
        Filesize

        584KB

      • memory/2152-28-0x0000000000400000-0x0000000000724000-memory.dmp
        Filesize

        3.1MB

      • memory/2152-38-0x0000000005900000-0x000000000590A000-memory.dmp
        Filesize

        40KB

      • memory/2152-47-0x0000000074FA0000-0x0000000075750000-memory.dmp
        Filesize

        7.7MB

      • memory/2860-45-0x0000000000980000-0x000000000098E000-memory.dmp
        Filesize

        56KB

      • memory/2860-46-0x0000000074FA0000-0x0000000075750000-memory.dmp
        Filesize

        7.7MB

      • memory/2860-48-0x000000007EFA0000-0x000000007EFB0000-memory.dmp
        Filesize

        64KB

      • memory/2860-50-0x0000000074FA0000-0x0000000075750000-memory.dmp
        Filesize

        7.7MB

      • memory/4928-36-0x00007FFE8ACB0000-0x00007FFE8B771000-memory.dmp
        Filesize

        10.8MB

      • memory/4928-13-0x00007FFE8ACB0000-0x00007FFE8B771000-memory.dmp
        Filesize

        10.8MB