Analysis
-
max time kernel
127s -
max time network
144s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-06-2024 12:51
Behavioral task
behavioral1
Sample
getrat.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
getrat.exe
Resource
win11-20240426-en
General
-
Target
getrat.exe
-
Size
409KB
-
MD5
18b1039a3013abc959410add72aab2d2
-
SHA1
23fc4f25ea5bcb635254b8b6ef6cb79d05f4372d
-
SHA256
74072cb82f64ed34239c3841331663624e148cf50d7dc9cf340c71ebff24e6fd
-
SHA512
924791c7854c522e772e531dfa9fbf44be6f8da3532a82135138d6b5b803f190e680988436b55b64f29ca6cf2eb0af397769d299ce00f48200ea66b1c04964df
-
SSDEEP
6144:jMs9p1kREG60olIZHeDzCNz3IqR21C7+bXakEA8b/jt/vIBKPrx5:LpiREGJ3ZHeDzC7RHiSXt/vIB0rv
Malware Config
Extracted
quasar
3.1.5
SeroXen | v3.1.5 |
adult-mai.gl.at.ply.gg:51745
$Sxr-jy6vh8CtEJL5ceZuIb
-
encryption_key
1TbGeXOsJEBH7iT0wKPt
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
lol
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2128-1-0x0000000000730000-0x000000000079C000-memory.dmp family_quasar C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
$sxr-powershell.exepid process 5008 $sxr-powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Drops file in System32 directory 4 IoCs
Processes:
getrat.exe$sxr-powershell.exedescription ioc process File created C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe getrat.exe File opened for modification C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe getrat.exe File opened for modification C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe $sxr-powershell.exe File opened for modification C:\Windows\SysWOW64\$sxr-seroxen2 $sxr-powershell.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeSCHTASKS.exepid process 4028 schtasks.exe 2680 schtasks.exe 4312 SCHTASKS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
getrat.exe$sxr-powershell.exedescription pid process Token: SeDebugPrivilege 2128 getrat.exe Token: SeDebugPrivilege 5008 $sxr-powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
$sxr-powershell.exepid process 5008 $sxr-powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
getrat.exe$sxr-powershell.exedescription pid process target process PID 2128 wrote to memory of 2680 2128 getrat.exe schtasks.exe PID 2128 wrote to memory of 2680 2128 getrat.exe schtasks.exe PID 2128 wrote to memory of 2680 2128 getrat.exe schtasks.exe PID 2128 wrote to memory of 5008 2128 getrat.exe $sxr-powershell.exe PID 2128 wrote to memory of 5008 2128 getrat.exe $sxr-powershell.exe PID 2128 wrote to memory of 5008 2128 getrat.exe $sxr-powershell.exe PID 2128 wrote to memory of 4312 2128 getrat.exe SCHTASKS.exe PID 2128 wrote to memory of 4312 2128 getrat.exe SCHTASKS.exe PID 2128 wrote to memory of 4312 2128 getrat.exe SCHTASKS.exe PID 5008 wrote to memory of 4028 5008 $sxr-powershell.exe schtasks.exe PID 5008 wrote to memory of 4028 5008 $sxr-powershell.exe schtasks.exe PID 5008 wrote to memory of 4028 5008 $sxr-powershell.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\getrat.exe"C:\Users\Admin\AppData\Local\Temp\getrat.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "lol" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\getrat.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe"C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "lol" /sc ONLOGON /tr "C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77getrat.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\getrat.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\$sxr-seroxen2\$sxr-powershell.exeFilesize
409KB
MD518b1039a3013abc959410add72aab2d2
SHA123fc4f25ea5bcb635254b8b6ef6cb79d05f4372d
SHA25674072cb82f64ed34239c3841331663624e148cf50d7dc9cf340c71ebff24e6fd
SHA512924791c7854c522e772e531dfa9fbf44be6f8da3532a82135138d6b5b803f190e680988436b55b64f29ca6cf2eb0af397769d299ce00f48200ea66b1c04964df
-
memory/2128-6-0x00000000060C0000-0x00000000060D2000-memory.dmpFilesize
72KB
-
memory/2128-2-0x0000000005810000-0x0000000005DB6000-memory.dmpFilesize
5.6MB
-
memory/2128-3-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/2128-4-0x00000000743E0000-0x0000000074B91000-memory.dmpFilesize
7.7MB
-
memory/2128-5-0x0000000005260000-0x00000000052C6000-memory.dmpFilesize
408KB
-
memory/2128-0-0x00000000743EE000-0x00000000743EF000-memory.dmpFilesize
4KB
-
memory/2128-7-0x00000000065F0000-0x000000000662C000-memory.dmpFilesize
240KB
-
memory/2128-1-0x0000000000730000-0x000000000079C000-memory.dmpFilesize
432KB
-
memory/2128-16-0x00000000743E0000-0x0000000074B91000-memory.dmpFilesize
7.7MB
-
memory/5008-13-0x00000000743E0000-0x0000000074B91000-memory.dmpFilesize
7.7MB
-
memory/5008-14-0x00000000743E0000-0x0000000074B91000-memory.dmpFilesize
7.7MB
-
memory/5008-18-0x0000000006F30000-0x0000000006F3A000-memory.dmpFilesize
40KB
-
memory/5008-19-0x00000000743E0000-0x0000000074B91000-memory.dmpFilesize
7.7MB