Analysis
- max time kernel
140s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 16:25
General
- Target SecuriteInfo.com.Trojan.TR.Dropper.Gen.31130.17125.exe
- Size 12KB
- Sample240809-twzlvasfrn
- SHA256 b8009341f881ba620519fbda30335ea2cc6b4a1eb4fb0216c0d908b7aaf26686
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
147.45.44.138:4782
-
74661366-3221-4ef8-a135-99063277201a
-
encryption_key
9F5E83CF4EAD1B51E34A8D5F82E492881AB9FF3B
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Yandex.service
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen.31130.17125.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.TR.Dropper.Gen.31130.17125.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SubDir'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\SubDir\NkCUVyfGoReONT1k.exe"C:\Users\Admin\AppData\Roaming\SubDir\NkCUVyfGoReONT1k.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Yandex.service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Yandex.service" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gnasx4av.sxk.ps1
memory/920-16-0x00007FF965A30000-0x00007FF9664F1000-memory.dmp
memory/920-2-0x00000146B48B0000-0x00000146B48D2000-memory.dmp
memory/920-12-0x00007FF965A30000-0x00007FF9664F1000-memory.dmp
memory/920-13-0x00007FF965A30000-0x00007FF9664F1000-memory.dmp
memory/1252-38-0x000000001BE40000-0x000000001BE90000-memory.dmp
memory/1252-39-0x000000001BF50000-0x000000001C002000-memory.dmp
memory/1252-42-0x000000001BED0000-0x000000001BEE2000-memory.dmp
memory/1252-43-0x000000001CA50000-0x000000001CA8C000-memory.dmp
memory/3972-1-0x000001A484930000-0x000001A48493A000-memory.dmp
memory/3972-0-0x00007FF965A33000-0x00007FF965A35000-memory.dmp
memory/3972-17-0x00007FF965A30000-0x00007FF9664F1000-memory.dmp
memory/3972-31-0x00007FF965A30000-0x00007FF9664F1000-memory.dmp
memory/5084-30-0x0000000000A90000-0x0000000000DB4000-memory.dmp