Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 07:59
Behavioral task
behavioral1
Sample
c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe
Resource
win7-20240903-en
General
-
Target
c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe
-
Size
363KB
-
MD5
94be4081af6754ba534f62d8968ffc71
-
SHA1
7f6504db5850ba020e23e69f5e6357e65ab0ef75
-
SHA256
c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7
-
SHA512
0588987187e34b1b3b63cf8e8c0ef258fa2dc781fe2d43108ba8af9a8b85fba1dcde57824c6fdb867f64f64f1007b184d0f9ab990f7c92c6ea0b3e27339d19f9
-
SSDEEP
6144:mcqQ4i1FFiEKDtupn0Ah9EbGCIl8De5erLfyH1F0YaaSk:HplihMnp9nuCkqHEYaab
Malware Config
Extracted
quasar
1.3.0.0
minigame
103.47.224.39:4782
QSR_MUTEX_LQvzas16MNIL3IavoG
-
encryption_key
aBtW2exC5zUctYcKM4IY
-
install_name
winrar-x64-701.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/4080-1-0x00000000000F0000-0x0000000000152000-memory.dmp family_quasar behavioral2/files/0x000a000000023b7f-10.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 1776 winrar-x64-701.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\SubDir\winrar-x64-701.exe c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe File opened for modification C:\Program Files (x86)\SubDir\winrar-x64-701.exe c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winrar-x64-701.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 540 schtasks.exe 1952 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe Token: SeDebugPrivilege 1776 winrar-x64-701.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1776 winrar-x64-701.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4080 wrote to memory of 540 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe 84 PID 4080 wrote to memory of 540 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe 84 PID 4080 wrote to memory of 540 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe 84 PID 4080 wrote to memory of 1776 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe 86 PID 4080 wrote to memory of 1776 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe 86 PID 4080 wrote to memory of 1776 4080 c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe 86 PID 1776 wrote to memory of 1952 1776 winrar-x64-701.exe 91 PID 1776 wrote to memory of 1952 1776 winrar-x64-701.exe 91 PID 1776 wrote to memory of 1952 1776 winrar-x64-701.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe"C:\Users\Admin\AppData\Local\Temp\c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7.exe" /rl HIGHEST /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:540
-
-
C:\Program Files (x86)\SubDir\winrar-x64-701.exe"C:\Program Files (x86)\SubDir\winrar-x64-701.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Program Files (x86)\SubDir\winrar-x64-701.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1952
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
363KB
MD594be4081af6754ba534f62d8968ffc71
SHA17f6504db5850ba020e23e69f5e6357e65ab0ef75
SHA256c6687f7bff8c2637685c5510e159abe6014d8b52cff618f40c265e5dcbcce1c7
SHA5120588987187e34b1b3b63cf8e8c0ef258fa2dc781fe2d43108ba8af9a8b85fba1dcde57824c6fdb867f64f64f1007b184d0f9ab990f7c92c6ea0b3e27339d19f9