Analysis

  • max time kernel
    94s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 15:54

General

  • Target

    KRcLFIz5PCQunB7.exe

  • Size

    3.5MB

  • MD5

    a08b35662044abf9528c24c3f663eaed

  • SHA1

    aee7831f263e6b83198a790d8a8948a841a600e2

  • SHA256

    3f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295

  • SHA512

    0866868cbf52999b233546348cde08c3cfcf2deef86830a319d8430e6d815a02b8438f46c944fbd9f2010d7e9fcb6f4f77db490280894b899de0afc71278b5dd

  • SSDEEP

    49152:Uf+eHq329+bhPCNJZxh2H4s0E04nfxhFZ9kIODfdWutT825SkDh83TQ237w4fGi:U+MrJZqYsTfnFZ9ktfgtSSTQ23s4p

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

FLO

C2

qtd.ydns.eu:5829

Mutex

ac3de377-7a66-4586-b523-567adbbba988

Attributes
  • encryption_key

    C5B555A83D127A9553D4FB1FCECB35CE8E91A447

  • install_name

    outlooks.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Outlooks

  • subdirectory

    WindowsUpdates

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe
    "C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe
      "C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"
      2⤵
        PID:780
      • C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe
        "C:\Users\Admin\AppData\Local\Temp\KRcLFIz5PCQunB7.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks" /create /tn "Outlooks" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe" /rl HIGHEST /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1596
        • C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe
          "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3748
          • C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe
            "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"
            4⤵
            • Executes dropped EXE
            PID:2944
          • C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe
            "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\SysWOW64\schtasks.exe
              "schtasks" /create /tn "Outlooks" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe" /rl HIGHEST /f
              5⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4360

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KRcLFIz5PCQunB7.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Roaming\WindowsUpdates\outlooks.exe

      Filesize

      3.5MB

      MD5

      a08b35662044abf9528c24c3f663eaed

      SHA1

      aee7831f263e6b83198a790d8a8948a841a600e2

      SHA256

      3f233256d32f8c33884510be0e50b614a35642f6ed7cb76b1f480373b548b295

      SHA512

      0866868cbf52999b233546348cde08c3cfcf2deef86830a319d8430e6d815a02b8438f46c944fbd9f2010d7e9fcb6f4f77db490280894b899de0afc71278b5dd

    • memory/1504-13-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1504-22-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1504-15-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/1504-11-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB

    • memory/1784-40-0x0000000008050000-0x00000000080B6000-memory.dmp

      Filesize

      408KB

    • memory/1784-39-0x0000000007FA0000-0x0000000007FDC000-memory.dmp

      Filesize

      240KB

    • memory/1784-38-0x0000000007F40000-0x0000000007F52000-memory.dmp

      Filesize

      72KB

    • memory/1784-35-0x0000000006AA0000-0x0000000006B52000-memory.dmp

      Filesize

      712KB

    • memory/1784-34-0x0000000006830000-0x0000000006880000-memory.dmp

      Filesize

      320KB

    • memory/1784-33-0x0000000006CE0000-0x00000000072F8000-memory.dmp

      Filesize

      6.1MB

    • memory/3748-26-0x0000000005960000-0x0000000005972000-memory.dmp

      Filesize

      72KB

    • memory/3748-23-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3748-32-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3748-25-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3748-24-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4100-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

      Filesize

      4KB

    • memory/4100-7-0x00000000749FE000-0x00000000749FF000-memory.dmp

      Filesize

      4KB

    • memory/4100-8-0x00000000056D0000-0x00000000056E2000-memory.dmp

      Filesize

      72KB

    • memory/4100-9-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4100-14-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4100-10-0x0000000007790000-0x0000000007AF8000-memory.dmp

      Filesize

      3.4MB

    • memory/4100-5-0x00000000054B0000-0x00000000054BA000-memory.dmp

      Filesize

      40KB

    • memory/4100-6-0x0000000005770000-0x000000000580C000-memory.dmp

      Filesize

      624KB

    • memory/4100-4-0x00000000749F0000-0x00000000751A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4100-3-0x00000000054E0000-0x0000000005572000-memory.dmp

      Filesize

      584KB

    • memory/4100-2-0x00000000059F0000-0x0000000005F94000-memory.dmp

      Filesize

      5.6MB

    • memory/4100-1-0x0000000000860000-0x0000000000BF0000-memory.dmp

      Filesize

      3.6MB