Analysis

  • max time kernel
    138s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 09:46

General

  • Target

    d5cfd09fd7161493290e9e15a2bdbe15.msi

  • Size

    4.8MB

  • MD5

    d5cfd09fd7161493290e9e15a2bdbe15

  • SHA1

    d9494f1c796f4b301692f0d16b54248514258fd4

  • SHA256

    e8a5b808ec57fa33d43f8ca7cc74a7c7e00166dc9307fe1e82fc1e099f0cf5e6

  • SHA512

    900aff0edc22a4f727909b54e8c6f85af9496e1957a8b9b5444c55b90dca15715e442b5958cecffa55a68f10d5e6b8cb56e220e005602569fd1cdbade3c75a02

  • SSDEEP

    98304:2kufFjyn453oxsC3gB02bIE2g32rYEc2ufqcn2:2kN4+WCL2yg3yuCZ

Malware Config

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Drops startup file 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 13 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d5cfd09fd7161493290e9e15a2bdbe15.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3560
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1B660F234BB3C0348CAA3F5768D464A9
      2⤵
      • Drops startup file
      • Blocklisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Users\Public\Videos\Rar.exe
        "C:\Users\Public\Videos\Rar.exe" x -df -y "C:\Users\Public\Videos\4264AEE2-12ED-D1A6-CC0E-592088C8E805.rar" "C:\Users\Public\Videos\"
        3⤵
        • Executes dropped EXE
        PID:2012
      • C:\Users\Public\Videos\4A073466-D405-7164-BCBC-08428D72F4A4.exe
        "C:\Users\Public\Videos\4A073466-D405-7164-BCBC-08428D72F4A4.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: GetForegroundWindowSpam
        PID:3472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\e57aaba.rbs

    Filesize

    8KB

    MD5

    67bd1972ced82ade01ff4b3b1e174e20

    SHA1

    2b910185c9cc483e16be12d53030ade9187b1586

    SHA256

    010a1459c9b6568aeeb019a073b2a614e0a0c7c8b6d8b746053207c826c008c8

    SHA512

    996eb7c63fbaf8bf4e28e90e207c705ae5c1f664807bf87e12520f663f6db980081b1f79b9d0550829b65de0fcfab8e267165f597b05a57d3fcdf52ae4ff8261

  • C:\Users\Public\Videos\4264AEE2-12ED-D1A6-CC0E-592088C8E805.rar

    Filesize

    5.2MB

    MD5

    37cbc8e2984692b482baf3c7a63caf0e

    SHA1

    4f6b410e8236bde9680bf0d763de7da70582f2cd

    SHA256

    c087eeefacdfcce51e9d4218832a522eef4bf7058ebc3390e98298b04859412e

    SHA512

    9211151d2acac76e7cd36ae3508fe9827153703af533bd16eb6652a5271e25f0bba83702cfec5efacd34e1d7882fb5f2450e1e332adfd652680fcd659e968799

  • C:\Users\Public\Videos\EIUWI383IE

    Filesize

    639KB

    MD5

    c00caf990793d69120a0abc4bf0e3210

    SHA1

    f5556f65bdbc1dd62286d353312646215a14f079

    SHA256

    04c777837d0d418e78fddbbb35587b205e1a424adda5a552363e2164cf2df686

    SHA512

    a93365fc0ecf746c074d08fd784c6af7556d06e2646b2b167b67d03554e8dcc37f67804562fcdb4a09a2e117db3f893e4cc192280145531354cea7605e834e14

  • C:\Users\Public\Videos\Rar.exe

    Filesize

    744KB

    MD5

    16659ae52ce03889ad19db1f5710c6aa

    SHA1

    66b814fe3be64229e2cc19f0a4460e123ba74971

    SHA256

    0b1866b627d8078d296e7d39583c9f856117be79c1d226b8c9378fe075369118

    SHA512

    f9dd360c3a230131c08c4d5f838457f690ed4094ec166acd9f141b7603f649cfa71a47ea80e9ff41b8296246bdc1c72a75288f9a836c18431e06c2e8e3fc8398

  • C:\Users\Public\Videos\tier0_s64.dll

    Filesize

    385KB

    MD5

    a986b3caa090d8c2cc75955c983f2da9

    SHA1

    7108c3a44918bfb35bff01bd654eeb23df0b6abd

    SHA256

    68380282f65cd2a772f6743b05761f9abd6c4dcf0f326af2e0873e5f0985f985

    SHA512

    474aef5956f128466e0c28601e1b36da252bdcf442d9fa8fe82e70875d172a2dbafdb9135780782be83ea6b7e226043ac62ee7d2b4d1059fcdf08296754da4e9

  • C:\Users\Public\Videos\vstdlib_s64.dll

    Filesize

    6.1MB

    MD5

    eaa6283d8347efa2e55ca93521fcd401

    SHA1

    4328270dba1cf7bb4f33e039697dbbf88743c665

    SHA256

    69967f642ef23e5b53f7c010f6971872abf2f008218ffbbd964229f3e62d19bb

    SHA512

    51b2e5916b04119db855a97149b717d1626da9574ddfb1d5735e9904ce943b52a93c935c417eb39faf6f6760575da7bc3e6d1c4a2d9ec61877319e958e5a702a

  • C:\Windows\Installer\MSIAB05.tmp

    Filesize

    816KB

    MD5

    aa88d8f40a286b6d40de0f3abc836cfa

    SHA1

    c24eab9e4b10b159b589f4c3b64ef3db111ea1c8

    SHA256

    8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1

    SHA512

    6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519

  • memory/3472-129-0x000001937AE60000-0x000001937B48A000-memory.dmp

    Filesize

    6.2MB

  • memory/3472-142-0x00007FFDBA670000-0x00007FFDBAC9A000-memory.dmp

    Filesize

    6.2MB

  • memory/3472-144-0x0000019362000000-0x0000019362012000-memory.dmp

    Filesize

    72KB