Resubmissions

04-08-2024 16:51

240804-vcxhtazejn 10

03-08-2024 18:23

240803-w1gb6swbnb 10

Analysis

  • max time kernel
    33s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-08-2024 16:51

General

  • Target

    Solara.exe

  • Size

    3.1MB

  • MD5

    3cf4f19b7c69135acb3c4c9bb9cdfb90

  • SHA1

    e2b5a40dd2abfa03671fde7c4e74f9b2846f989f

  • SHA256

    6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

  • SHA512

    4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

  • SSDEEP

    49152:DvehBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaxAtueYFoGdXTHHB72eh2NT:DvAt2d5aKCuVPzlEmVQ0wvwf+tuee

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

nohchy-47404.portmap.host:47404

Mutex

1a1e174b-dbf8-49ad-9b43-2cfbb233a6d9

Attributes
  • encryption_key

    795CDD46D2CDD422BE523F263B64E03D8B6AAD42

  • install_name

    SolaraExecutor.exe

  • log_directory

    Logs

  • reconnect_delay

    2000

  • startup_key

    RtkAudUService64

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 2 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solara.exe
    "C:\Users\Admin\AppData\Local\Temp\Solara.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4332
    • C:\Windows\system32\SubDir\SolaraExecutor.exe
      "C:\Windows\system32\SubDir\SolaraExecutor.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:232
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2668
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6ROHiET42FcS.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:3232
          • C:\Windows\system32\PING.EXE
            ping -n 10 localhost
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:3860
          • C:\Windows\system32\SubDir\SolaraExecutor.exe
            "C:\Windows\system32\SubDir\SolaraExecutor.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4144
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4752
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWlkQLIJg1Gk.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2820
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:448
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  6⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:4812
                • C:\Windows\system32\SubDir\SolaraExecutor.exe
                  "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:3168
                  • C:\Windows\SYSTEM32\schtasks.exe
                    "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                    7⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:4628
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h2E6UD4IKvcY.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4676
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:332
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:3548
                      • C:\Windows\system32\SubDir\SolaraExecutor.exe
                        "C:\Windows\system32\SubDir\SolaraExecutor.exe"
                        8⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:4968
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f
                          9⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3636
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fsXrOeSVWF5l.bat" "
                          9⤵
                            PID:4836
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              10⤵
                                PID:5020

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraExecutor.exe.log

              Filesize

              2KB

              MD5

              8f0271a63446aef01cf2bfc7b7c7976b

              SHA1

              b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

              SHA256

              da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

              SHA512

              78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

            • C:\Users\Admin\AppData\Local\Temp\6ROHiET42FcS.bat

              Filesize

              204B

              MD5

              1bafa3c591b129c6a61e4f0ca5f8e490

              SHA1

              4e38e209563ffe58460f66cb72e2af2f0614910f

              SHA256

              1bae0cd6f2ce8a62e530ee35e5001985142540f55ac9b02ba32e94911375eef5

              SHA512

              c1a57a411095c8250a57c3e831eb209ca1423a78ff308070e522879c4869ffa8c96285f2d847898702ffc5308f9b9fcee1c39254f845ec48d99354528940166c

            • C:\Users\Admin\AppData\Local\Temp\fWlkQLIJg1Gk.bat

              Filesize

              204B

              MD5

              bcabf8a1b8d7f802cd9f301120ca6f97

              SHA1

              5a8bcdb5621ea7c1294a893cc1599153f1cb617a

              SHA256

              7007c19e4f70d5c20ea7dc2a5829211de20531e853e0210f97216c92494dc8cd

              SHA512

              d4ea871a8130a1613c008bba7f0c346079d30e7466964b6d96e7d24827b9fb6d07f535c359f514be7703dc0d5665ef54854369690da1766205391a0dcb108637

            • C:\Users\Admin\AppData\Local\Temp\fsXrOeSVWF5l.bat

              Filesize

              204B

              MD5

              4d1b203483cc980460a9da61bff80cc7

              SHA1

              20f26c0423cd2fe545f1da13f2d9befa2e9164ae

              SHA256

              5e7d8f0600258fcaa2dc30657c7b1a6a7fc91c37b3da5a120624523dde05074b

              SHA512

              8c14b216c915d8a7c3e154794a9ecf789dc44ca6b62a22400062b0f77e416f74c82b3153e5a3f11a613f7d139854de8dad5e47b272357b88bc64d1ad874ffa35

            • C:\Users\Admin\AppData\Local\Temp\h2E6UD4IKvcY.bat

              Filesize

              204B

              MD5

              c20b910c00a2c4e9257b9496d00eac2f

              SHA1

              2e8a8db0b8c422cf3e6a2771932779e921a9a78e

              SHA256

              fd3243cc779803fa7b85895a3b204f116a50f0c8d92414ff6fbea9d9089cfe97

              SHA512

              7845b6455844b71e4e26e179fd6da438fb285d2b289294807ddb6946ff707093053ff9639192503007abc839b8abfef6139161e3f23efe95e6fa9b581f4bbe94

            • C:\Windows\system32\SubDir\SolaraExecutor.exe

              Filesize

              3.1MB

              MD5

              3cf4f19b7c69135acb3c4c9bb9cdfb90

              SHA1

              e2b5a40dd2abfa03671fde7c4e74f9b2846f989f

              SHA256

              6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

              SHA512

              4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

            • memory/232-10-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

              Filesize

              10.8MB

            • memory/232-11-0x000000001C1D0000-0x000000001C220000-memory.dmp

              Filesize

              320KB

            • memory/232-12-0x000000001C2E0000-0x000000001C392000-memory.dmp

              Filesize

              712KB

            • memory/232-18-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

              Filesize

              10.8MB

            • memory/232-8-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

              Filesize

              10.8MB

            • memory/4960-9-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

              Filesize

              10.8MB

            • memory/4960-0-0x00007FFA7F9B3000-0x00007FFA7F9B5000-memory.dmp

              Filesize

              8KB

            • memory/4960-2-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

              Filesize

              10.8MB

            • memory/4960-1-0x00000000001A0000-0x00000000004C4000-memory.dmp

              Filesize

              3.1MB