Overview

overview

10

Static

static

3

2024-06-06...uk.exe

windows7-x64

10

2024-06-06...uk.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-06-06_e19f2d8b706b8ae8390bcb5ee7b10d1f_cova_ryuk

  • Size

    2.2MB

  • Sample

    240606-kv41hada84

  • MD5

    e19f2d8b706b8ae8390bcb5ee7b10d1f

  • SHA1

    d1bf74445805bb2b9744aaf272e70166fe07bbfd

  • SHA256

    c3ff697ffa3ccf61ac56655f9334a66645a1fb86274ea16ecf43b797a753e567

  • SHA512

    6d74c88abc84eb7390a7c8245e8d5f4a361e293e07b49ff2b08021e5f864319faf6a1b886d628cb861d27baab9560a67521a9baa5f68e50f592663ead0ee8c68

  • SSDEEP

    49152:BwN7fzYcFe7I3TEK24Y9/qTjtfdI7dHiCgqAmcP1Qy8rPGZfEvYENf/rHi1y:4YcFe8gT/qfJM9i8KuxKyp/rHis

Score
10/10
quasartest1persistencespywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Test1

C2

192.168.100.7:4782

192.168.100.1:4782

192.168.100.2:4782

192.168.100.3:4782

192.168.100.4:4782

192.168.100.5:4782

192.168.100.6:4782

192.168.100.8:4782

192.168.100.9:4782
Mutex

QSR_MUTEX_EUcqtx8KrCdmvD2YIx

Attributes
  • encryption_key

    riVWKQv6KwgHqOuBNiok

  • install_name

    Microsoft.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft

  • subdirectory

    SubDir

Targets

    • Target

      2024-06-06_e19f2d8b706b8ae8390bcb5ee7b10d1f_cova_ryuk

    • Size

      2.2MB

    • MD5

      e19f2d8b706b8ae8390bcb5ee7b10d1f

    • SHA1

      d1bf74445805bb2b9744aaf272e70166fe07bbfd

    • SHA256

      c3ff697ffa3ccf61ac56655f9334a66645a1fb86274ea16ecf43b797a753e567

    • SHA512

      6d74c88abc84eb7390a7c8245e8d5f4a361e293e07b49ff2b08021e5f864319faf6a1b886d628cb861d27baab9560a67521a9baa5f68e50f592663ead0ee8c68

    • SSDEEP

      49152:BwN7fzYcFe7I3TEK24Y9/qTjtfdI7dHiCgqAmcP1Qy8rPGZfEvYENf/rHi1y:4YcFe8gT/qfJM9i8KuxKyp/rHis

    Score
    10/10
    quasartest1persistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables containing common artifacts observed in infostealers

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks