Resubmissions

04-08-2024 16:51

240804-vcxhtazejn 10

03-08-2024 18:23

240803-w1gb6swbnb 10

Analysis

  • max time kernel
    36s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    04-08-2024 16:51

General

  • Target

    Solara.exe

  • Size

    3.1MB

  • MD5

    3cf4f19b7c69135acb3c4c9bb9cdfb90

  • SHA1

    e2b5a40dd2abfa03671fde7c4e74f9b2846f989f

  • SHA256

    6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

  • SHA512

    4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

  • SSDEEP

    49152:DvehBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaxAtueYFoGdXTHHB72eh2NT:DvAt2d5aKCuVPzlEmVQ0wvwf+tuee

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

nohchy-47404.portmap.host:47404

Mutex

1a1e174b-dbf8-49ad-9b43-2cfbb233a6d9

Attributes
  • encryption_key

    795CDD46D2CDD422BE523F263B64E03D8B6AAD42

  • install_name

    SolaraExecutor.exe

  • log_directory

    Logs

  • reconnect_delay

    2000

  • startup_key

    RtkAudUService64

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2804
    • C:\Windows\system32\SubDir\SolaraExecutor.exe
      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2104
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2764
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CT6bXt5CxLas.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:2740
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:2756
          • C:\Windows\system32\SubDir\SolaraExecutor.exe
            "C:\Windows\system32\SubDir\SolaraExecutor.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2504
            • C:\Windows\system32\schtasks.exe
              "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2712
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\WIxghe6J72A2.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2900
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:2904
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2908
                • C:\Windows\system32\SubDir\SolaraExecutor.exe
                  "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:1584
                  • C:\Windows\system32\schtasks.exe
                    "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:316
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\zQzrVRLuH4Ji.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2224
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:576
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:2208
                      • C:\Windows\system32\SubDir\SolaraExecutor.exe
                        "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:2412
                        • C:\Windows\system32\schtasks.exe
                          "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1028
                        • C:\Windows\system32\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\dg1ilPiU5AO4.bat" "
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:832
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:2848
                            • C:\Windows\system32\PING.EXE
                              ping -n 10 localhost
                              10⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2840

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\CT6bXt5CxLas.bat

            Filesize

            204B

            MD5

            72784a64b54490cf9ffbc141a8b703c4

            SHA1

            af9a995f006f512291557ceb6585411941171398

            SHA256

            3a7a32da0359cb46da4fc2310d2d73911ebf62ec6d499361dba9c4ce9ff7c6dd

            SHA512

            ddc1c27522f0e6a4c79c34b86d81ced9696face7f0d2112c05ac827c227959ca6eee8ff21f6270a3ccf9733b1b489b2e8ae1638d83568b8a919555325c1050cc

          • C:\Users\Admin\AppData\Local\Temp\WIxghe6J72A2.bat

            Filesize

            204B

            MD5

            fb193cbcd311baec3e9695fa7f5640a3

            SHA1

            93d2fa858588e5a91d65572ae33680a0cbbe7d52

            SHA256

            fadf49cca7a3f97a3073ce268dc9b79e97c5dda71c9777b0ca5cd450198c21e4

            SHA512

            151d781d6ad516e9e021961adc5b0f9a3327369924e658c606035eddd8fcbfc2e83e3497dce22f02be4c4a7e96fa68fde3c2551e65add7e80435186bda50ffed

          • C:\Users\Admin\AppData\Local\Temp\dg1ilPiU5AO4.bat

            Filesize

            204B

            MD5

            87ef57f858c352289f7abdc012e205e1

            SHA1

            33aea67f466be2ade4dc177e9fb467f15a916899

            SHA256

            cb13ff6c981929279123c8ca13f2cfba14d8d17dcfe5b7a627771f3376240298

            SHA512

            33390cfaad0eaa9c0126f36acaa689061540b0ba8025de91ff741c8784d8158a9c1952ba34e59a983752cbb69c5e79a629fa63e121eddd3dbd96596e1189a0ed

          • C:\Users\Admin\AppData\Local\Temp\zQzrVRLuH4Ji.bat

            Filesize

            204B

            MD5

            ed31c75270cd65af903344433d60dfc6

            SHA1

            3f30eeb1f05f76146d0252e796e5c9f28c215e86

            SHA256

            5fce4e4297baf948fca351365ecb09a848d02676967a754459995e9a6048fef3

            SHA512

            c6e11d14a3f0255585bf940600cad03d5098637599fd48adc22e19e1f8c9624446fd94e560cb14521962bceac0b05dcb2d44cff7c79b1ffbe38da5c09a1839c5

          • C:\Windows\System32\SubDir\SolaraExecutor.exe

            Filesize

            3.1MB

            MD5

            3cf4f19b7c69135acb3c4c9bb9cdfb90

            SHA1

            e2b5a40dd2abfa03671fde7c4e74f9b2846f989f

            SHA256

            6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

            SHA512

            4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

          • \??\PIPE\lsarpc

            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

          • memory/1584-33-0x0000000000A70000-0x0000000000D94000-memory.dmp

            Filesize

            3.1MB

          • memory/2104-10-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

            Filesize

            9.9MB

          • memory/2104-9-0x00000000011B0000-0x00000000014D4000-memory.dmp

            Filesize

            3.1MB

          • memory/2104-19-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

            Filesize

            9.9MB

          • memory/2104-8-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

            Filesize

            9.9MB

          • memory/2412-45-0x0000000000B50000-0x0000000000E74000-memory.dmp

            Filesize

            3.1MB

          • memory/2504-22-0x0000000000050000-0x0000000000374000-memory.dmp

            Filesize

            3.1MB

          • memory/2864-0-0x000007FEF65F3000-0x000007FEF65F4000-memory.dmp

            Filesize

            4KB

          • memory/2864-7-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

            Filesize

            9.9MB

          • memory/2864-2-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

            Filesize

            9.9MB

          • memory/2864-1-0x0000000000DA0000-0x00000000010C4000-memory.dmp

            Filesize

            3.1MB