Analysis
- max time kernel
597s - max time network
599s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
28/04/2024, 00:05
General
- Target IDTOIPBYR_0.exe
- Size 38KB
- Sample240428-ac5tzabe55
- SHA256 c924d7502dcf3af74739270218066f0431678e122fa35aefefdacc1edd2b1b0c
Malware Config
Extracted
-
quasar
-
3.1.5
-
Office04
-
147.185.221.19:33587
-
$Sxr-lG7PreqFKmNhJc0CKS
-
encryption_key
11fnZjAdVB1EIQVhl7wn
-
install_name
DLLrunhost.exe
-
log_directory
UpdLogs
-
reconnect_delay
3000
-
startup_key
WindowsAudioHelper
-
subdirectory
Windows
Signatures
- Quasar RAT 3 IoCs
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe"C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe" /rl HIGHEST /f2⤵
- Quasar RAT
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe"C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\DLLrunhost.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath (Get-Item -LiteralPath $env:SystemRoot).Root"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /flushdns2⤵
- Gathers network information
-
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77IDTOIPBYR_0.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDTOIPBYR_0.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2ufkrpbp.wn5.ps1
DLLrunhost.exe
memory/520-56-0x00000000070E0000-0x00000000070F1000-memory.dmp
memory/520-42-0x0000000071260000-0x00000000712AC000-memory.dmp
memory/520-58-0x0000000007130000-0x0000000007144000-memory.dmp
memory/520-57-0x0000000007120000-0x000000000712E000-memory.dmp
memory/520-41-0x0000000006EC0000-0x0000000006EF2000-memory.dmp
memory/520-55-0x00000000070B0000-0x00000000070BA000-memory.dmp
memory/520-60-0x0000000007160000-0x0000000007168000-memory.dmp
memory/520-54-0x0000000007E10000-0x000000000848A000-memory.dmp
memory/520-53-0x0000000006F10000-0x0000000006FB3000-memory.dmp
memory/520-16-0x0000000002760000-0x0000000002770000-memory.dmp
memory/520-15-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/520-17-0x00000000025A0000-0x00000000025D6000-memory.dmp
memory/520-59-0x0000000007170000-0x000000000718A000-memory.dmp
memory/520-21-0x0000000004D50000-0x0000000004DB6000-memory.dmp
memory/520-18-0x0000000002760000-0x0000000002770000-memory.dmp
memory/520-20-0x0000000004CB0000-0x0000000004CD2000-memory.dmp
memory/520-63-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/520-28-0x0000000005530000-0x0000000005884000-memory.dmp
memory/520-52-0x0000000006EA0000-0x0000000006EBE000-memory.dmp
memory/520-34-0x0000000005B90000-0x0000000005BAE000-memory.dmp
memory/520-35-0x0000000005C20000-0x0000000005C6C000-memory.dmp
memory/520-19-0x0000000004E00000-0x0000000005428000-memory.dmp
memory/520-38-0x0000000006B90000-0x0000000006C26000-memory.dmp
memory/520-40-0x0000000006110000-0x0000000006132000-memory.dmp
memory/520-39-0x0000000006060000-0x000000000607A000-memory.dmp
memory/2000-14-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/2000-37-0x0000000006620000-0x000000000662A000-memory.dmp
memory/2000-65-0x00000000051D0000-0x00000000051E0000-memory.dmp
memory/2000-64-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/2000-13-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/2084-5-0x0000000004EC0000-0x0000000004F26000-memory.dmp
memory/2084-6-0x0000000005270000-0x0000000005282000-memory.dmp
memory/2084-7-0x0000000006060000-0x000000000609C000-memory.dmp
memory/2084-4-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/2084-3-0x0000000004E20000-0x0000000004EB2000-memory.dmp
memory/2084-2-0x00000000052B0000-0x0000000005854000-memory.dmp
memory/2084-1-0x0000000074760000-0x0000000074F10000-memory.dmp
memory/2084-0-0x00000000003A0000-0x000000000040E000-memory.dmp
memory/2084-29-0x0000000074760000-0x0000000074F10000-memory.dmp