Analysis

  • max time kernel
    212s
  • max time network
    300s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27-05-2024 23:25

General

  • Target

    New.exe

  • Size

    409KB

  • MD5

    cf570b21f42f0ce411b7c9961068931e

  • SHA1

    f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d

  • SHA256

    d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234

  • SHA512

    de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684

  • SSDEEP

    12288:jpyJcC+PgUUboV2hShYoyTyrIh9eqh6bIK+Pz9:9wd+Y2IweyA9eqkMZ

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

Video

C2

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-oWTh3ZS9htfe80iIl5

Attributes
  • encryption_key

    zK8u0rpHf4TJzGf65Flt

  • install_name

    Win11.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 11 Boot

  • subdirectory

    Win11

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New.exe
    "C:\Users\Admin\AppData\Local\Temp\New.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1Pu4kK0nZ1GL.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
          PID:4720
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 10 localhost
          3⤵
          • Runs ping.exe
          PID:3992
      • C:\Windows\SysWOW64\SCHTASKS.exe
        "SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST
        2⤵
        • Creates scheduled task(s)
        PID:4648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\1Pu4kK0nZ1GL.bat

      Filesize

      260B

      MD5

      2dedd42362a90a721d4700553de023ed

      SHA1

      e3974c125cdbe411a0110207b40723854bbd0c90

      SHA256

      df2b5669f1f564df5f4929c415c5ee5d9eb4c09a474b44230a8bd3ce5b712445

      SHA512

      cb46389bf7a7faa19a362f62fe99e670118a4898a303f3eb8ee8f3602e7a73e41ffc22476a9f979fcf3ce55ef6594a95d0e059902f597f23482d6225765ff948

    • C:\Users\Admin\AppData\Roaming\$sxr-Logs\05-27-~1

      Filesize

      224B

      MD5

      c906612cf0067cbc9d22ea083cac6bae

      SHA1

      44df01af9e4b23396c6c7a224f24834a34bcf69a

      SHA256

      d83e7c884a32ef8cdc29692d253f196201a430caaa3407b4a296c02bc5a9a66e

      SHA512

      266e2c5aa2b041c45d91cd91f2bcc008059275a39949c5dbb15c4142a7153ae84e548d6cf988818252fb5d5e7fd374b4e57fc1a0c5e5b94d765360b2867b99c0

    • memory/2740-6-0x0000000006350000-0x0000000006362000-memory.dmp

      Filesize

      72KB

    • memory/2740-3-0x00000000056B0000-0x0000000005742000-memory.dmp

      Filesize

      584KB

    • memory/2740-4-0x00000000744B0000-0x0000000074C61000-memory.dmp

      Filesize

      7.7MB

    • memory/2740-5-0x0000000005750000-0x00000000057B6000-memory.dmp

      Filesize

      408KB

    • memory/2740-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

      Filesize

      4KB

    • memory/2740-7-0x00000000068A0000-0x00000000068DC000-memory.dmp

      Filesize

      240KB

    • memory/2740-9-0x0000000006D60000-0x0000000006D6A000-memory.dmp

      Filesize

      40KB

    • memory/2740-10-0x00000000744BE000-0x00000000744BF000-memory.dmp

      Filesize

      4KB

    • memory/2740-11-0x00000000744B0000-0x0000000074C61000-memory.dmp

      Filesize

      7.7MB

    • memory/2740-2-0x0000000005C60000-0x0000000006206000-memory.dmp

      Filesize

      5.6MB

    • memory/2740-17-0x00000000744B0000-0x0000000074C61000-memory.dmp

      Filesize

      7.7MB

    • memory/2740-1-0x0000000000C50000-0x0000000000CBC000-memory.dmp

      Filesize

      432KB