Overview
overview
10Static
static
10Release (1).rar
windows7-x64
3Release (1).rar
windows10-2004-x64
3Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1IDTOIPBYR_0.deps.json
windows7-x64
3IDTOIPBYR_0.deps.json
windows10-2004-x64
3IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.exe
windows7-x64
10IDTOIPBYR_0.exe
windows10-2004-x64
10IDTOIPBYR_0.pdb
windows7-x64
3IDTOIPBYR_0.pdb
windows10-2004-x64
3IDTOIPBYR_...g.json
windows7-x64
3IDTOIPBYR_...g.json
windows10-2004-x64
3System.Management.dll
windows7-x64
1System.Management.dll
windows10-2004-x64
1Analysis
-
max time kernel
576s -
max time network
592s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 00:05
Behavioral task
behavioral1
Sample
Release (1).rar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Release (1).rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Guna.UI2.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
Guna.UI2.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
IDTOIPBYR_0.deps.json
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
IDTOIPBYR_0.deps.json
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
IDTOIPBYR_0.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
IDTOIPBYR_0.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
IDTOIPBYR_0.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
IDTOIPBYR_0.pdb
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
IDTOIPBYR_0.pdb
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
IDTOIPBYR_0.runtimeconfig.json
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
System.Management.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
System.Management.dll
Resource
win10v2004-20240419-en
General
-
Target
IDTOIPBYR_0.exe
-
Size
413KB
-
MD5
aabcedbac7ad8b10993f6de878be1ba4
-
SHA1
be8ea58edc1e83ebf33fe0e87a29916e9c554426
-
SHA256
4466cd4392c0fa3c49979664630db1b607e129c858fd44507cf5fc6b5b9dd3ba
-
SHA512
5a2bb094997699335a149ca353dc5e98e66482aa9dadc52502068337760bbd65bd648b3935777f4424e9811705657bcd2eb38254d731d892256d578c1f1eaf66
-
SSDEEP
6144:2gmEjkzQT1TVNSeE7E11zVeusnib8YoVHR8z0n7kgpMRqZGe:T1TVVXEo13eusHnVH9pMRWGe
Malware Config
Extracted
quasar
3.1.5
Office04
147.185.221.19:33587
$Sxr-lG7PreqFKmNhJc0CKS
-
encryption_key
11fnZjAdVB1EIQVhl7wn
-
install_name
DLLrunhost.exe
-
log_directory
UpdLogs
-
reconnect_delay
3000
-
startup_key
WindowsAudioHelper
-
subdirectory
Windows
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral10/memory/2652-0-0x0000000000670000-0x00000000006DE000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe family_quasar -
Drops file in Drivers directory 1 IoCs
Processes:
IDTOIPBYR_0.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts IDTOIPBYR_0.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IDTOIPBYR_0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation IDTOIPBYR_0.exe -
Executes dropped EXE 1 IoCs
Processes:
DLLrunhost.exepid process 4592 DLLrunhost.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com 10 api.ipify.org 11 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeSCHTASKS.exepid process 4000 schtasks.exe 3212 schtasks.exe 932 SCHTASKS.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1488 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2056 powershell.exe 2056 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
IDTOIPBYR_0.exepowershell.exeDLLrunhost.exedescription pid process Token: SeDebugPrivilege 2652 IDTOIPBYR_0.exe Token: SeDebugPrivilege 2056 powershell.exe Token: SeDebugPrivilege 4592 DLLrunhost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DLLrunhost.exepid process 4592 DLLrunhost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
IDTOIPBYR_0.exeDLLrunhost.exedescription pid process target process PID 2652 wrote to memory of 3212 2652 IDTOIPBYR_0.exe schtasks.exe PID 2652 wrote to memory of 3212 2652 IDTOIPBYR_0.exe schtasks.exe PID 2652 wrote to memory of 3212 2652 IDTOIPBYR_0.exe schtasks.exe PID 2652 wrote to memory of 4592 2652 IDTOIPBYR_0.exe DLLrunhost.exe PID 2652 wrote to memory of 4592 2652 IDTOIPBYR_0.exe DLLrunhost.exe PID 2652 wrote to memory of 4592 2652 IDTOIPBYR_0.exe DLLrunhost.exe PID 2652 wrote to memory of 2056 2652 IDTOIPBYR_0.exe powershell.exe PID 2652 wrote to memory of 2056 2652 IDTOIPBYR_0.exe powershell.exe PID 2652 wrote to memory of 2056 2652 IDTOIPBYR_0.exe powershell.exe PID 2652 wrote to memory of 1488 2652 IDTOIPBYR_0.exe ipconfig.exe PID 2652 wrote to memory of 1488 2652 IDTOIPBYR_0.exe ipconfig.exe PID 2652 wrote to memory of 1488 2652 IDTOIPBYR_0.exe ipconfig.exe PID 2652 wrote to memory of 932 2652 IDTOIPBYR_0.exe SCHTASKS.exe PID 2652 wrote to memory of 932 2652 IDTOIPBYR_0.exe SCHTASKS.exe PID 2652 wrote to memory of 932 2652 IDTOIPBYR_0.exe SCHTASKS.exe PID 4592 wrote to memory of 4000 4592 DLLrunhost.exe schtasks.exe PID 4592 wrote to memory of 4000 4592 DLLrunhost.exe schtasks.exe PID 4592 wrote to memory of 4000 4592 DLLrunhost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe"C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe"C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath (Get-Item -LiteralPath $env:SystemRoot).Root"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77IDTOIPBYR_0.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxebqkq3.0if.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exeFilesize
413KB
MD5aabcedbac7ad8b10993f6de878be1ba4
SHA1be8ea58edc1e83ebf33fe0e87a29916e9c554426
SHA2564466cd4392c0fa3c49979664630db1b607e129c858fd44507cf5fc6b5b9dd3ba
SHA5125a2bb094997699335a149ca353dc5e98e66482aa9dadc52502068337760bbd65bd648b3935777f4424e9811705657bcd2eb38254d731d892256d578c1f1eaf66
-
memory/2056-27-0x0000000005680000-0x00000000059D4000-memory.dmpFilesize
3.3MB
-
memory/2056-17-0x0000000004DD0000-0x00000000053F8000-memory.dmpFilesize
6.2MB
-
memory/2056-56-0x00000000072A0000-0x00000000072A8000-memory.dmpFilesize
32KB
-
memory/2056-32-0x0000000005CD0000-0x0000000005CEE000-memory.dmpFilesize
120KB
-
memory/2056-55-0x00000000072B0000-0x00000000072CA000-memory.dmpFilesize
104KB
-
memory/2056-54-0x0000000007270000-0x0000000007284000-memory.dmpFilesize
80KB
-
memory/2056-53-0x0000000007260000-0x000000000726E000-memory.dmpFilesize
56KB
-
memory/2056-52-0x0000000007220000-0x0000000007231000-memory.dmpFilesize
68KB
-
memory/2056-51-0x00000000071F0000-0x00000000071FA000-memory.dmpFilesize
40KB
-
memory/2056-50-0x0000000007F20000-0x000000000859A000-memory.dmpFilesize
6.5MB
-
memory/2056-16-0x0000000004700000-0x0000000004736000-memory.dmpFilesize
216KB
-
memory/2056-36-0x0000000006230000-0x0000000006252000-memory.dmpFilesize
136KB
-
memory/2056-49-0x0000000007050000-0x00000000070F3000-memory.dmpFilesize
652KB
-
memory/2056-20-0x0000000004D00000-0x0000000004D22000-memory.dmpFilesize
136KB
-
memory/2056-21-0x0000000005400000-0x0000000005466000-memory.dmpFilesize
408KB
-
memory/2056-48-0x0000000006FE0000-0x0000000006FFE000-memory.dmpFilesize
120KB
-
memory/2056-38-0x0000000070820000-0x000000007086C000-memory.dmpFilesize
304KB
-
memory/2056-33-0x0000000005D00000-0x0000000005D4C000-memory.dmpFilesize
304KB
-
memory/2056-37-0x0000000007000000-0x0000000007032000-memory.dmpFilesize
200KB
-
memory/2056-34-0x0000000006CA0000-0x0000000006D36000-memory.dmpFilesize
600KB
-
memory/2056-35-0x00000000061C0000-0x00000000061DA000-memory.dmpFilesize
104KB
-
memory/2652-5-0x00000000051E0000-0x0000000005246000-memory.dmpFilesize
408KB
-
memory/2652-2-0x0000000005650000-0x0000000005BF4000-memory.dmpFilesize
5.6MB
-
memory/2652-4-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/2652-1-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/2652-19-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/2652-0-0x0000000000670000-0x00000000006DE000-memory.dmpFilesize
440KB
-
memory/2652-6-0x0000000005E00000-0x0000000005E12000-memory.dmpFilesize
72KB
-
memory/2652-3-0x0000000005140000-0x00000000051D2000-memory.dmpFilesize
584KB
-
memory/2652-8-0x0000000005280000-0x0000000005290000-memory.dmpFilesize
64KB
-
memory/2652-7-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4592-14-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4592-15-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/4592-59-0x00000000752D0000-0x0000000075A80000-memory.dmpFilesize
7.7MB
-
memory/4592-60-0x00000000053B0000-0x00000000053C0000-memory.dmpFilesize
64KB
-
memory/4592-62-0x0000000006C00000-0x0000000006C0A000-memory.dmpFilesize
40KB