Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240730-en
  • resource tags

    arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-07-2024 00:22

General

  • Target

    2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe

  • Size

    294KB

  • MD5

    58ccb4c9da26dbf5584194406ee2f4b3

  • SHA1

    ae91798532b747f410099ef7d0e36bffeca6361c

  • SHA256

    2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97

  • SHA512

    dff6b4bf25fc5b5cf1a64ee645fb0310b072ec69c89a6e863cf9e0800e1d36f8dc4e567cf19c7dc8ac704d351b604cbf8d35959c3a64a10aa6b54f5c8fedb3c2

  • SSDEEP

    6144:M3VPjut1s07wltS102nj9W0t3KMONuGfpul4EdSCM:gZjut1s0qQj9ztaMMdxop3M

Malware Config

Extracted

Family

redline

Botnet

exodusmarket.io

C2

91.92.240.111:1334

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

51.222.21.20:4782

Mutex

374acc94-a8cd-45c6-bc31-752e0f83541d

Attributes
  • encryption_key

    5B2A5F50FABB3F6748116D7077D95758D0DFFC77

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchost

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe
    "C:\Users\Admin\AppData\Local\Temp\2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Local\Temp\pureee.exe
        "C:\Users\Admin\AppData\Local\Temp\pureee.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5004
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2004
      • C:\Users\Admin\AppData\Local\Temp\adada.exe
        "C:\Users\Admin\AppData\Local\Temp\adada.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1528
      • C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
        "C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\adada.exe

    Filesize

    3.1MB

    MD5

    9c682f5b5000cd003e76530706955a72

    SHA1

    1a69da76e05d114a317342dae3e9c7b10f107d43

    SHA256

    36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522

    SHA512

    33bd859542e1ae74d8c81427af44022cb91861dc02ee4202505f1e010487d06cb27e1aa83be6af17be4e2d8973289595b2ebe9bdf99a187956662df30b6dc88f

  • C:\Users\Admin\AppData\Local\Temp\dropperrr.exe

    Filesize

    476KB

    MD5

    35e7f1f850ca524d0eaa6522a4451834

    SHA1

    e98db252a62c84fd87416d2ec347de46ec053ebd

    SHA256

    2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e

    SHA512

    3b013378a51a29652ff84f61050b344f504ef51a51944d469b1d0e629e4abad979416a56b9cffb6cfe20b80dfbebffec35dce6f5dc10b02907dee538f9f17a01

  • C:\Users\Admin\AppData\Local\Temp\pureee.exe

    Filesize

    662KB

    MD5

    0006ad7b9f2a9b304e5b3790f6f18807

    SHA1

    00db2c60fca8aec6b504dd8fd4861a2e59a21fe9

    SHA256

    014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450

    SHA512

    31fcde22e25be698ef2efd44cc65b758e8c9e8b62504f3254f9cc44bfaabdaa0c94cefceac12833372f8b2797b6bd0205bb9c8f1626e25ee4117d886198fb7db

  • C:\Users\Admin\AppData\Local\Temp\tmpCA94.tmp

    Filesize

    40KB

    MD5

    a182561a527f929489bf4b8f74f65cd7

    SHA1

    8cd6866594759711ea1836e86a5b7ca64ee8911f

    SHA256

    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

    SHA512

    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

  • C:\Users\Admin\AppData\Local\Temp\tmpCAAA.tmp

    Filesize

    114KB

    MD5

    d780b7995f84e5487be452d63157855b

    SHA1

    7df258685a42cb5cbff54aca7a8f347f16397ea6

    SHA256

    cc4eb56ac9e6043d5476d834932ef8eb9cfd4abaabe88ed9f6afdc5b70d42619

    SHA512

    d58077340001c6a1bd2b3280316a668c87e3dc8a4c7a1f8ff362bc29436ba4a214b3157474546b9876db2144fb4b570d6d7ef66d84481072996ef1760fe6fdb5

  • C:\Users\Admin\AppData\Local\Temp\tmpCAE5.tmp

    Filesize

    46KB

    MD5

    14ccc9293153deacbb9a20ee8f6ff1b7

    SHA1

    46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

    SHA256

    3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

    SHA512

    916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

  • C:\Users\Admin\AppData\Local\Temp\tmpCAFA.tmp

    Filesize

    20KB

    MD5

    22be08f683bcc01d7a9799bbd2c10041

    SHA1

    2efb6041cf3d6e67970135e592569c76fc4c41de

    SHA256

    451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

    SHA512

    0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

  • C:\Users\Admin\AppData\Local\Temp\tmpCB10.tmp

    Filesize

    112KB

    MD5

    87210e9e528a4ddb09c6b671937c79c6

    SHA1

    3c75314714619f5b55e25769e0985d497f0062f2

    SHA256

    eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

    SHA512

    f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

  • C:\Users\Admin\AppData\Local\Temp\tmpCB4B.tmp

    Filesize

    96KB

    MD5

    40f3eb83cc9d4cdb0ad82bd5ff2fb824

    SHA1

    d6582ba879235049134fa9a351ca8f0f785d8835

    SHA256

    cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

    SHA512

    cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

  • memory/2068-0-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

    Filesize

    4KB

  • memory/2344-300-0x0000000000CC0000-0x0000000000FE4000-memory.dmp

    Filesize

    3.1MB

  • memory/3772-11-0x0000000006CB0000-0x0000000006D16000-memory.dmp

    Filesize

    408KB

  • memory/3772-10-0x00000000071E0000-0x000000000770C000-memory.dmp

    Filesize

    5.2MB

  • memory/3772-9-0x0000000006AE0000-0x0000000006CA2000-memory.dmp

    Filesize

    1.8MB

  • memory/3772-8-0x0000000005920000-0x0000000005A2A000-memory.dmp

    Filesize

    1.0MB

  • memory/3772-7-0x00000000743F0000-0x0000000074BA1000-memory.dmp

    Filesize

    7.7MB

  • memory/3772-6-0x0000000005570000-0x00000000055BC000-memory.dmp

    Filesize

    304KB

  • memory/3772-5-0x0000000005530000-0x000000000556C000-memory.dmp

    Filesize

    240KB

  • memory/3772-166-0x0000000006FC0000-0x0000000007036000-memory.dmp

    Filesize

    472KB

  • memory/3772-167-0x00000000070E0000-0x0000000007172000-memory.dmp

    Filesize

    584KB

  • memory/3772-168-0x0000000007CC0000-0x0000000008266000-memory.dmp

    Filesize

    5.6MB

  • memory/3772-169-0x0000000007730000-0x000000000774E000-memory.dmp

    Filesize

    120KB

  • memory/3772-194-0x00000000743FE000-0x00000000743FF000-memory.dmp

    Filesize

    4KB

  • memory/3772-195-0x00000000743F0000-0x0000000074BA1000-memory.dmp

    Filesize

    7.7MB

  • memory/3772-4-0x00000000054D0000-0x00000000054E2000-memory.dmp

    Filesize

    72KB

  • memory/3772-1-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/3772-2-0x00000000743FE000-0x00000000743FF000-memory.dmp

    Filesize

    4KB

  • memory/3772-3-0x0000000005C10000-0x0000000006228000-memory.dmp

    Filesize

    6.1MB

  • memory/5004-259-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-237-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-247-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-273-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-288-0x00007FF908860000-0x00007FF909322000-memory.dmp

    Filesize

    10.8MB

  • memory/5004-271-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-270-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-267-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-265-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-263-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-261-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-225-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-257-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-255-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-253-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-251-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-249-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-245-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-243-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-241-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-239-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-231-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-209-0x000001E8FF8D0000-0x000001E8FF9DA000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-208-0x00007FF908863000-0x00007FF908865000-memory.dmp

    Filesize

    8KB

  • memory/5004-210-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-235-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-233-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-229-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-227-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-223-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-221-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-219-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-207-0x000001E8E5260000-0x000001E8E530A000-memory.dmp

    Filesize

    680KB

  • memory/5004-217-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-215-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-213-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-211-0x000001E8FF8D0000-0x000001E8FF9D5000-memory.dmp

    Filesize

    1.0MB

  • memory/5004-4244-0x000001E880070000-0x000001E8800C6000-memory.dmp

    Filesize

    344KB

  • memory/5004-4245-0x000001E8800D0000-0x000001E88011C000-memory.dmp

    Filesize

    304KB

  • memory/5004-4254-0x00007FF908863000-0x00007FF908865000-memory.dmp

    Filesize

    8KB

  • memory/5004-4255-0x00007FF908860000-0x00007FF909322000-memory.dmp

    Filesize

    10.8MB