Analysis Overview
SHA256
e775b42335e7764a5bf9e695f68272c68fc68de16d20bd3b11af95632edcfc5b
Threat Level: Known bad
The file TestforKio.exe was found to be: Known bad.
Malicious Activity Summary
Quasar family
Quasar RAT
Quasar payload
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
Enumerates physical storage devices
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Runs ping.exe
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-29 19:13
Signatures
Quasar family
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-29 19:13
Reported
2024-06-29 19:16
Platform
win11-20240611-en
Max time kernel
90s
Max time network
94s
Command Line
Signatures
Quasar RAT
Quasar payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | 8.tcp.ngrok.io | N/A | N/A |
Enumerates physical storage devices
Runs ping.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\PING.EXE | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\TestforKio.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TestforKio.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2888 wrote to memory of 456 | N/A | C:\Users\Admin\AppData\Local\Temp\TestforKio.exe | C:\Windows\system32\cmd.exe |
| PID 2888 wrote to memory of 456 | N/A | C:\Users\Admin\AppData\Local\Temp\TestforKio.exe | C:\Windows\system32\cmd.exe |
| PID 456 wrote to memory of 4748 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\chcp.com |
| PID 456 wrote to memory of 4748 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\chcp.com |
| PID 456 wrote to memory of 2400 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\PING.EXE |
| PID 456 wrote to memory of 2400 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\PING.EXE |
Processes
C:\Users\Admin\AppData\Local\Temp\TestforKio.exe
"C:\Users\Admin\AppData\Local\Temp\TestforKio.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9RmSfPkLQZwh.bat" "
C:\Windows\system32\chcp.com
chcp 65001
C:\Windows\system32\PING.EXE
ping -n 10 localhost
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.tcp.ngrok.io | udp |
| US | 3.142.167.4:18001 | 8.tcp.ngrok.io | tcp |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| US | 8.8.8.8:53 | 90.57.201.195.in-addr.arpa | udp |
| US | 3.142.167.4:18001 | 8.tcp.ngrok.io | tcp |
| US | 3.142.167.4:18001 | 8.tcp.ngrok.io | tcp |
Files
memory/2888-0-0x00007FFB5DF03000-0x00007FFB5DF05000-memory.dmp
memory/2888-1-0x0000000000350000-0x0000000000674000-memory.dmp
memory/2888-2-0x00007FFB5DF00000-0x00007FFB5E9C2000-memory.dmp
memory/2888-3-0x000000001BBA0000-0x000000001BBF0000-memory.dmp
memory/2888-4-0x000000001BCB0000-0x000000001BD62000-memory.dmp
memory/2888-7-0x000000001BC20000-0x000000001BC32000-memory.dmp
memory/2888-8-0x000000001C6C0000-0x000000001C6FC000-memory.dmp
memory/2888-9-0x00007FFB5DF03000-0x00007FFB5DF05000-memory.dmp
memory/2888-10-0x00007FFB5DF00000-0x00007FFB5E9C2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9RmSfPkLQZwh.bat
| MD5 | 24321d9b49b2ec4fd081311d089e7bbf |
| SHA1 | 7dddb53cde368c35da47a261e28ffd91b4886954 |
| SHA256 | ece59d3f00b238ef13f359f16c874f0c6b5acaf3d3b3b26f364a77c08ad0befc |
| SHA512 | 981f810080f8bbd7f5450b6a1960e58572935e53222a1603f8f56e56350a78f04d557cdad86658042868133590bf1fee2a62e3688a0e74006198b4d9f5c57d44 |
memory/2888-16-0x00007FFB5DF00000-0x00007FFB5E9C2000-memory.dmp