Analysis
-
max time kernel
4s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 23:54
Behavioral task
behavioral1
Sample
SystemPropertiesPerformance.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SystemPropertiesPerformance.exe
Resource
win10v2004-20240802-en
General
-
Target
SystemPropertiesPerformance.exe
-
Size
2.0MB
-
MD5
1c990f90b5e821825afe64e3b15eadec
-
SHA1
c217d4abb7a9f19589e59e252ed781e36b9e99d8
-
SHA256
409c5e0592dd38bf0d316a06bbe0d73732b07a4cc6bae85aae87a1f4c56c6f62
-
SHA512
59176d283118f56d78e665a40441defdfd91ddd6d29965c2b76d25f72eeadc2bc9a23c5683b88fea55b7d87517b490b5b7c2f13b028e4c1746ed1270b314125c
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYy:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YE
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
flow ioc pid Process 4304 schtasks.exe 15 ip-api.com Process not Found 51 ip-api.com Process not Found -
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x00070000000234b5-17.dat family_quasar behavioral2/memory/804-32-0x0000000000840000-0x000000000089E000-memory.dmp family_quasar behavioral2/files/0x00070000000234b8-50.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation SystemPropertiesPerformance.exe -
Executes dropped EXE 3 IoCs
pid Process 3200 vnc.exe 804 windef.exe 4996 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: SystemPropertiesPerformance.exe File opened (read-only) \??\x: SystemPropertiesPerformance.exe File opened (read-only) \??\y: SystemPropertiesPerformance.exe File opened (read-only) \??\g: SystemPropertiesPerformance.exe File opened (read-only) \??\s: SystemPropertiesPerformance.exe File opened (read-only) \??\v: SystemPropertiesPerformance.exe File opened (read-only) \??\m: SystemPropertiesPerformance.exe File opened (read-only) \??\u: SystemPropertiesPerformance.exe File opened (read-only) \??\n: SystemPropertiesPerformance.exe File opened (read-only) \??\p: SystemPropertiesPerformance.exe File opened (read-only) \??\r: SystemPropertiesPerformance.exe File opened (read-only) \??\b: SystemPropertiesPerformance.exe File opened (read-only) \??\e: SystemPropertiesPerformance.exe File opened (read-only) \??\k: SystemPropertiesPerformance.exe File opened (read-only) \??\j: SystemPropertiesPerformance.exe File opened (read-only) \??\l: SystemPropertiesPerformance.exe File opened (read-only) \??\o: SystemPropertiesPerformance.exe File opened (read-only) \??\q: SystemPropertiesPerformance.exe File opened (read-only) \??\t: SystemPropertiesPerformance.exe File opened (read-only) \??\a: SystemPropertiesPerformance.exe File opened (read-only) \??\h: SystemPropertiesPerformance.exe File opened (read-only) \??\i: SystemPropertiesPerformance.exe File opened (read-only) \??\z: SystemPropertiesPerformance.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ip-api.com 51 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x00070000000234b8-50.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3472 set thread context of 3456 3472 SystemPropertiesPerformance.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 4692 3200 WerFault.exe 82 640 4996 WerFault.exe 95 2196 3584 WerFault.exe 113 3492 1488 WerFault.exe 118 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SystemPropertiesPerformance.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SystemPropertiesPerformance.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4580 PING.EXE 2608 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 4580 PING.EXE 2608 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2784 schtasks.exe 716 schtasks.exe 4304 schtasks.exe 772 schtasks.exe 4780 schtasks.exe 2744 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3472 SystemPropertiesPerformance.exe 3472 SystemPropertiesPerformance.exe 3472 SystemPropertiesPerformance.exe 3472 SystemPropertiesPerformance.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 804 windef.exe Token: SeDebugPrivilege 4996 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4996 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3472 wrote to memory of 3200 3472 SystemPropertiesPerformance.exe 82 PID 3472 wrote to memory of 3200 3472 SystemPropertiesPerformance.exe 82 PID 3472 wrote to memory of 3200 3472 SystemPropertiesPerformance.exe 82 PID 3472 wrote to memory of 804 3472 SystemPropertiesPerformance.exe 84 PID 3472 wrote to memory of 804 3472 SystemPropertiesPerformance.exe 84 PID 3472 wrote to memory of 804 3472 SystemPropertiesPerformance.exe 84 PID 3200 wrote to memory of 1532 3200 vnc.exe 85 PID 3200 wrote to memory of 1532 3200 vnc.exe 85 PID 3200 wrote to memory of 1532 3200 vnc.exe 85 PID 3472 wrote to memory of 3456 3472 SystemPropertiesPerformance.exe 87 PID 3472 wrote to memory of 3456 3472 SystemPropertiesPerformance.exe 87 PID 3472 wrote to memory of 3456 3472 SystemPropertiesPerformance.exe 87 PID 3472 wrote to memory of 3456 3472 SystemPropertiesPerformance.exe 87 PID 3472 wrote to memory of 3456 3472 SystemPropertiesPerformance.exe 87 PID 3472 wrote to memory of 4304 3472 SystemPropertiesPerformance.exe 89 PID 3472 wrote to memory of 4304 3472 SystemPropertiesPerformance.exe 89 PID 3472 wrote to memory of 4304 3472 SystemPropertiesPerformance.exe 89 PID 804 wrote to memory of 772 804 windef.exe 93 PID 804 wrote to memory of 772 804 windef.exe 93 PID 804 wrote to memory of 772 804 windef.exe 93 PID 804 wrote to memory of 4996 804 windef.exe 95 PID 804 wrote to memory of 4996 804 windef.exe 95 PID 804 wrote to memory of 4996 804 windef.exe 95 PID 4996 wrote to memory of 4780 4996 winsock.exe 98 PID 4996 wrote to memory of 4780 4996 winsock.exe 98 PID 4996 wrote to memory of 4780 4996 winsock.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 5483⤵
- Program crash
PID:4692
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:772
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eodWj7dpG8MA.bat" "4⤵PID:4360
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:632
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4580
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:1488
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:2744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dzgo0HjKQPCz.bat" "6⤵PID:3104
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:3336
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2608
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵PID:2788
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f8⤵
- Scheduled Task/Job: Scheduled Task
PID:716
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 22366⤵
- Program crash
PID:3492
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 19964⤵
- Program crash
PID:640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"C:\Users\Admin\AppData\Local\Temp\SystemPropertiesPerformance.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3456
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Quasar RAT
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3200 -ip 32001⤵PID:4752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4996 -ip 49961⤵PID:548
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:3584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 5203⤵
- Program crash
PID:2196
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:1980
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:1580
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3584 -ip 35841⤵PID:616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1488 -ip 14881⤵PID:3708
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2056
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:216
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD51cb434db60851e33442fa421a806161f
SHA15dada50b661aaf03e0d41bbf7774d0e336e286b0
SHA25663324d3e675996ffe5e8002ed00ad169406f00c3f5a4f8b6d865dd08126ec86f
SHA512262e7f5da23c1d3e7daf4e88fc746e82b23d8695c160d4d9a823203e050e5a3564dc4598f4906b42b3cdc16834f46fda83f3ec1aac203fec452b80241b94d613
-
Filesize
208B
MD5cb3c9ec91d0cd86abc74db3e35906816
SHA14931cb7e7835a476aaeca309ba103ab5e9f409f7
SHA2568bc48f92d0c1c0877af4427133ec49a8a28068a9745b052df5c646ba2a1c141e
SHA512746febc1cc853b64b8884dbe4c817f74599688315759779075ab8387b980134c2ece63be0bf14492ee1e08f0731375d095a41644ca62ee0ea666ea711c9117e3
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD55f437ac4b2cd93e007ca1ce2a9ac7c22
SHA1b33f5f32790646683a081b7d2ae9dea95478153d
SHA256a722e829b5a87f35c6f5c74967313402a76a1ae10335adbfeef64be5833e1d3c
SHA512326b8f81d7fa7972bc8968714b3ae3cbb0335cd7ba4f3f44188fb814d1743e1eb02fc9739a6e420d0be72d4497e53815595d8f94d78164cf1a7b1f92313f168c
-
Filesize
224B
MD567ec98d2a665236dcdbcb33141bf615e
SHA11b57d05036e21d50d264bcb8b2f97c47a0a08e3a
SHA2563c83b656862618073e72c3e816dc7fdcdcf6128b033902ef54f4a91b03b43410
SHA5128c00b1c0a043128ee1922d92ae8ae9d9cd95d648b30f3ce8d811b24bc22384ae11dbb9e3fc166d6609c0cacd09dacb3f95cdc38531f50ac96be34c4a310649c1
-
Filesize
2.0MB
MD5188ff80e8873df56c5cae946fa2ccd61
SHA17a5252eaf9ae27410493654fc9a587e102930a93
SHA25674bc0447e45417b3f998662ef5e1ffe0ed503aa263094eb750e40c4f27024a7d
SHA512c67af6ab1b0cb8584913f36852cafd137214f3b4fbe2daee933fb0f67b7baf41277c7c05d0d523f23b10bab82b50b68101c120bb64d2911d4c77affe46c28f8d