Analysis

  • max time kernel
    92s
  • max time network
    95s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    28-11-2024 03:40

General

  • Target

    PORQUEPUTASYANOSIRVE.7z

  • Size

    923KB

  • MD5

    d757d40193d311216967491e36fc2ba4

  • SHA1

    2dd90fa74c489da4f85bdf301053230b480a31fa

  • SHA256

    8a31693ddf8924f144ba19a8802766188bd13f1ed7eea7c226eb0e01a9e47685

  • SHA512

    9be26ab222457605eea0c42a4dbcfa80154cb384e6abf0db6a010fcca172a0eda8792b9e3fff9d67717f095f67448d9310c7e049f7fea8dd5907afe8bd462921

  • SSDEEP

    24576:q9gl2kNvEE7GFdGqXsShFTAkBojKLUI56eGk:46vbIGqXscAkW+h1

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

azxq0ap.localto.net:3425

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\PORQUEPUTASYANOSIRVE.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1388
  • C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe
    "C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3464
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1688
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3504
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc995ccc40,0x7ffc995ccc4c,0x7ffc995ccc58
      2⤵
        PID:2532
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:2060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1800,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=640 /prefetch:3
          2⤵
            PID:3656
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2324,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2504 /prefetch:8
            2⤵
              PID:3128
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:2524
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3256 /prefetch:1
                2⤵
                  PID:3720
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3748,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4504 /prefetch:1
                  2⤵
                    PID:4920
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4744,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4788 /prefetch:1
                    2⤵
                      PID:4720
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3428,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3380 /prefetch:8
                      2⤵
                        PID:1724
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4452,i,17047000141523366340,14021101019968603566,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4440 /prefetch:8
                        2⤵
                          PID:752
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:2936
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:1288

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            d2e5f91bdc871f09da53aafc11e33bfc

                            SHA1

                            873d098b91e1160913d1c6b2585bb43e39bf31da

                            SHA256

                            7536cad7c9135f4cad1a013f56616edf1e6e65836f176ff0fc21196021c03ce9

                            SHA512

                            8bca770e60999c532a006e98520c29f1612b802a4cd983dece34d56987a789d8e2e222b10ab20037444987e8bb3bbf7fce08736240031e5690b7b42fe8094982

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                            Filesize

                            215KB

                            MD5

                            2be38925751dc3580e84c3af3a87f98d

                            SHA1

                            8a390d24e6588bef5da1d3db713784c11ca58921

                            SHA256

                            1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

                            SHA512

                            1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                            Filesize

                            216B

                            MD5

                            4030efffd101ac109d18822bda477e57

                            SHA1

                            166bb5a15f3a6ef5e32b1d714075263a9af62aa0

                            SHA256

                            dbbbd3ce1dd928f7235a4fb5b88a2ffa10cf3828f2dfba8d90b06fa2049abd14

                            SHA512

                            0b3e1a2e28b2242b1f23d72cb309742dad01b6a9826e7a9753de29703ffeaf5e1297c5011dfbfe56a31cfc80ee66c913670c2ba99e767fd3a95e96f90b1a7734

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            356B

                            MD5

                            44c0c1fad014ec9b602a7bb95f77d43e

                            SHA1

                            d38fd45394e8a9b7f1a0cd9fedb8be1f79c8a1f9

                            SHA256

                            11e772622791cb5046293b2f40bc36fa6340de5ac1ccfa13d1823841dfa7e707

                            SHA512

                            3040c18f8f3f77b03292b91a4ce4ef01b9b745c4241ef7703bd49daee7b3d3886fdcbc8366d775760c34657d11e5c4495500e7f9ea9fc5f3cbd456ad41d7c826

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            e059d7247b11a862c25cc674e5451a45

                            SHA1

                            97d7fac2f7ca0b97457b9569af6c60a76133d1d8

                            SHA256

                            bf35c3882b1189e8d0b3bee1e45031a97410bcdf344f9949f0aabb87f30adb48

                            SHA512

                            2c137087ff747efa9e4484091d45572d9fbcf931fa59523551781f85371820a410f0e47ce290431a2aac49aa7f07fb908fca71ddf824373d23a2fef9c60799be

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            2bc980784b80b6280e7e07b292b4cf33

                            SHA1

                            ab29a38ab92147543eb62ed024bd44a13a928655

                            SHA256

                            6648def6afea254b398f86cd182bc11607ed0b53c2f9d145c8f87f6f78bfc698

                            SHA512

                            2970458a0c5e36ad0151b5907fc1cafe29d3e6d4764f8e3621ab57c837e4112addb3e004fd7474082d7da63473b518d4b44173dae23c92f417f0f2775e297615

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                            Filesize

                            15KB

                            MD5

                            db21bb1520f68a7ca39e741a205d3f51

                            SHA1

                            cb6d6ba179d7628c369b5932a541301e515d6057

                            SHA256

                            5a80c185aabb1d313ebdd749e396ee81b961dc6a5a8aec62bcfaeff8926aaec9

                            SHA512

                            145a6576c68eed827e68967e2e4a0a774f8b15e3a08c0a57e1e6b7024ec565f7daee3c6903e96ad0c5fad67df993d161065c5027ea6326bd7209de3502aeee62

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            236KB

                            MD5

                            c19a26c672278b217d3be3e0feaf34d6

                            SHA1

                            77096e6a20aac4b1ad52fd3d837f9f96906df357

                            SHA256

                            9ea435878aa9d0fe54f5ee3bb033627a46d07d75117ee5adac3cba7c11efe135

                            SHA512

                            40620731d2465d6a6008184b6d60442f1f286f14f3b597959026f505a91e1bd1fbad475c5ff877497b2bfef61b8cd9da6ac9c79b72d9f1db1d4f0f51d0db3e49

                          • C:\Users\Admin\Desktop\PORQUEPUTASYANOSIRVE.exe

                            Filesize

                            3.1MB

                            MD5

                            73565f33ed4d8741291cbb30409f1727

                            SHA1

                            4d3a54b28f3ea80f884a25905e27165bdc353109

                            SHA256

                            aafe953e627f9e733e101d7211f0c9594dbdf82ec4019b2c9aa361cbc478f0de

                            SHA512

                            d897b098ddcdc94ac9177bc9a90b700c8b9a7cfafa74f729beebf74a094f76a7bd69e764711bdfedcdd231465daef16e937676e391ca2c010df03fecc863b583

                          • memory/1704-15-0x000000001CD30000-0x000000001CD6C000-memory.dmp

                            Filesize

                            240KB

                          • memory/1704-11-0x000000001C230000-0x000000001C2E2000-memory.dmp

                            Filesize

                            712KB

                          • memory/1704-40-0x000000001D8A0000-0x000000001DDC8000-memory.dmp

                            Filesize

                            5.2MB

                          • memory/1704-10-0x000000001AFD0000-0x000000001B020000-memory.dmp

                            Filesize

                            320KB

                          • memory/1704-14-0x000000001C1A0000-0x000000001C1B2000-memory.dmp

                            Filesize

                            72KB

                          • memory/2720-9-0x00007FFC9F3C0000-0x00007FFC9FE82000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/2720-6-0x00007FFC9F3C0000-0x00007FFC9FE82000-memory.dmp

                            Filesize

                            10.8MB

                          • memory/2720-5-0x0000000000A30000-0x0000000000D54000-memory.dmp

                            Filesize

                            3.1MB

                          • memory/2720-4-0x00007FFC9F3C3000-0x00007FFC9F3C5000-memory.dmp

                            Filesize

                            8KB