Malware Analysis Report

2024-10-23 19:09

Sample ID 240524-fjcdwseb4w
Target eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858
SHA256 eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858
Tags
sigma1 quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858

Threat Level: Known bad

The file eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858 was found to be: Known bad.

Malicious Activity Summary

sigma1 quasar spyware trojan

Detects Windows executables referencing non-Windows User-Agents

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Quasar family

Quasar RAT

Quasar payload

Detects executables containing common artifacts observed in infostealers

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects Windows executables referencing non-Windows User-Agents

Detects executables containing common artifacts observed in infostealers

Executes dropped EXE

Enumerates physical storage devices

Unsigned PE

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-24 04:53

Signatures

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 04:53

Reported

2024-05-24 04:56

Platform

win7-20231129-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe C:\Windows\system32\schtasks.exe
PID 3048 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe C:\Windows\system32\schtasks.exe
PID 3048 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe C:\Windows\system32\schtasks.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe
PID 3048 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe
PID 3000 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe C:\Windows\system32\schtasks.exe
PID 3000 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe C:\Windows\system32\schtasks.exe
PID 3000 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe C:\Windows\system32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe

"C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "GTA 6 FREE" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe

"C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "GTA 6 FREE" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp

Files

memory/3048-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

memory/3048-1-0x00000000012C0000-0x00000000015E4000-memory.dmp

memory/3048-2-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe

MD5 bf8c567800917f3d6b761f7f90d45ca6
SHA1 d6d5a9a6edcaba021c5e7f88c7c0d29008313c54
SHA256 eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858
SHA512 e6e42c0252b7c85cf5f44a715b2d375cbaaf0e04ad3de5ed10e45f6dd1142f5e2ac76fcd276309094219de94abb61f2d80ebe9a75a256c92d7f10f411b9bcccd

memory/3000-7-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

memory/3048-8-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

memory/3000-9-0x0000000000070000-0x0000000000394000-memory.dmp

memory/3000-10-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

memory/3000-11-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 04:53

Reported

2024-05-24 04:56

Platform

win10v2004-20240508-en

Max time kernel

135s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe

"C:\Users\Admin\AppData\Local\Temp\eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "GTA 6 FREE" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe

"C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "GTA 6 FREE" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
N/A 192.168.119.132:4444 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
N/A 192.168.119.132:4444 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
N/A 192.168.119.132:4444 tcp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
N/A 192.168.119.132:4444 tcp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
N/A 192.168.119.132:4444 tcp
N/A 192.168.119.132:4444 tcp

Files

memory/4908-0-0x00007FFA19513000-0x00007FFA19515000-memory.dmp

memory/4908-1-0x0000000000F10000-0x0000000001234000-memory.dmp

memory/4908-2-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\GTA 6.exe

MD5 bf8c567800917f3d6b761f7f90d45ca6
SHA1 d6d5a9a6edcaba021c5e7f88c7c0d29008313c54
SHA256 eb695dfc6736d10a690da446229bbed7c63578e0176bafef8afb31deee7b7858
SHA512 e6e42c0252b7c85cf5f44a715b2d375cbaaf0e04ad3de5ed10e45f6dd1142f5e2ac76fcd276309094219de94abb61f2d80ebe9a75a256c92d7f10f411b9bcccd

memory/4908-8-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp

memory/4232-9-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp

memory/4232-10-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp

memory/4232-11-0x000000001C190000-0x000000001C1E0000-memory.dmp

memory/4232-12-0x000000001C2A0000-0x000000001C352000-memory.dmp

memory/4232-13-0x00007FFA19510000-0x00007FFA19FD1000-memory.dmp