Analysis
-
max time kernel
5s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 21:57
Behavioral task
behavioral1
Sample
ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe
Resource
win10v2004-20241007-en
General
-
Target
ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe
-
Size
2.0MB
-
MD5
a3ded7e9d3d450599b74aa494a670c67
-
SHA1
042473e84228e217e6386210264eee79e53d800c
-
SHA256
ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0
-
SHA512
9c11608f7c2eacc3e443cdc2529788e0215ac22e0e5566e6936a8f925c1807ad70c0a79c85b223da73ec398f0a02b7553c2f226c42bd86343adcb0b2654625ca
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKY3:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YN
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
description flow ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 12 ip-api.com Process not Found 51 ip-api.com Process not Found -
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023b89-12.dat family_quasar behavioral2/memory/4448-30-0x0000000000D00000-0x0000000000D5E000-memory.dmp family_quasar behavioral2/files/0x000a000000023b8c-46.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe -
Executes dropped EXE 3 IoCs
pid Process 2852 vnc.exe 4448 windef.exe 3756 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\q: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\t: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\y: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\b: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\g: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\l: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\m: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\u: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\v: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\z: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\e: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\h: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\j: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\r: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\i: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\n: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\x: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\w: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\a: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\k: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\p: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe File opened (read-only) \??\s: ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com 51 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023b8c-46.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 676 set thread context of 3784 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3560 2852 WerFault.exe 83 636 4472 WerFault.exe 100 4684 3756 WerFault.exe 96 3500 4632 WerFault.exe 122 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3864 PING.EXE 2128 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2128 PING.EXE 3864 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4052 schtasks.exe 3952 schtasks.exe 3860 schtasks.exe 1192 schtasks.exe 1228 schtasks.exe 2136 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4448 windef.exe Token: SeDebugPrivilege 3756 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3756 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 676 wrote to memory of 2852 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 83 PID 676 wrote to memory of 2852 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 83 PID 676 wrote to memory of 2852 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 83 PID 2852 wrote to memory of 4600 2852 vnc.exe 85 PID 2852 wrote to memory of 4600 2852 vnc.exe 85 PID 676 wrote to memory of 4448 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 86 PID 676 wrote to memory of 4448 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 86 PID 676 wrote to memory of 4448 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 86 PID 2852 wrote to memory of 4600 2852 vnc.exe 85 PID 676 wrote to memory of 3784 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 88 PID 676 wrote to memory of 3784 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 88 PID 676 wrote to memory of 3784 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 88 PID 676 wrote to memory of 3784 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 88 PID 676 wrote to memory of 3784 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 88 PID 676 wrote to memory of 2136 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 90 PID 676 wrote to memory of 2136 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 90 PID 676 wrote to memory of 2136 676 ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe 90 PID 4448 wrote to memory of 4052 4448 windef.exe 94 PID 4448 wrote to memory of 4052 4448 windef.exe 94 PID 4448 wrote to memory of 4052 4448 windef.exe 94 PID 4448 wrote to memory of 3756 4448 windef.exe 96 PID 4448 wrote to memory of 3756 4448 windef.exe 96 PID 4448 wrote to memory of 3756 4448 windef.exe 96 PID 3756 wrote to memory of 3952 3756 winsock.exe 97 PID 3756 wrote to memory of 3952 3756 winsock.exe 97 PID 3756 wrote to memory of 3952 3756 winsock.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe"C:\Users\Admin\AppData\Local\Temp\ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe"1⤵
- Quasar RAT
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 5483⤵
- Program crash
PID:3560
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4052
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qG3J3hZSGewW.bat" "4⤵PID:1948
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:1584
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3864
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:4632
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:1192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUEedZg5nC36.bat" "6⤵PID:2192
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:4444
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2128
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"7⤵PID:4880
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f8⤵
- Scheduled Task/Job: Scheduled Task
PID:1228
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 22366⤵
- Program crash
PID:3500
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 16724⤵
- Program crash
PID:4684
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe"C:\Users\Admin\AppData\Local\Temp\ca59028bc78254fc761a269d6518ffd68206c292067b367bc830defef4b86cd0.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3784
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 28521⤵PID:2020
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:4472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 5203⤵
- Program crash
PID:636
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:1564
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:4112
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4472 -ip 44721⤵PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3756 -ip 37561⤵PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4632 -ip 46321⤵PID:2688
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD5cca4d3b20cec85d547f4e7176672424b
SHA1c25277869671d1aed37732754120881033c9b31f
SHA256beef984b112191b3fd49ff01d9f3cfe6a855447e77ef5d389506d24f31e0c8eb
SHA512f4f87635b700c5046fc441635c86a85fd579ab6f049d7e3459e1011ad111ce499db531ac83f61d4f76891cdd62dff379411037d3ba42fe26bbc29c4a00a08544
-
Filesize
208B
MD59de90b062064f70678343ec2bf406063
SHA17ccbd94664a779e0d2e6b1cb7eca1af06090a78c
SHA2565f9b970ffd3b0e96d654444cb8def194b747407500b2ef0399db18957b84835c
SHA51232d5eb31aa052f6c850e17ed1b7a53b7c65f59702ff3d2d00eb12361605be19df151876569f22158e8377968ebef59474102c558de27940abcbfdf58445e8d2f
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD51e8c91b2e0d9feef640d58416b8bf3e4
SHA119152e5a3323f4283eb7508252407e34c83cb1fc
SHA256c82668cf506311878155c86c74d69bdc6ec0300ec5e2fe9ee4eb7b96ba12802e
SHA51244ea0473d0177c447fb8beaab33dc23d6de11e78d1fd497eb822a40fde0b222d3c49b8ee389c27a74938168faeaa14841a0dcdd19c3dd10fa31becaf750880d9
-
Filesize
224B
MD5a6154fe9d16f60c531bf7e78fb550742
SHA139aa4a817826d9cac365c6a5ce83ae52cfb625f4
SHA2560122e436121525858cf64313d67fed5d05c69a323b1225d98c47dcb6d2f899ed
SHA5127868bd9a55a353d012c7a2f645cf4da0e0a8971bc691beeaea24e03eb6a896967b259acc4fabaa9b774b42b6e3c32b0467d44e6090aacd7462f29b2cf7245288
-
Filesize
2.0MB
MD553c75a255e410cc2a5ed8c216c1d109e
SHA14c7795e6db6c21c33558cfdacbbebc7622ec8f38
SHA25661a9bf69d1e34ea9336163a4700107af731faf915b32b7b5126370e43c84e2a7
SHA5120a9a26886a6cb1a5195fe980005fe84e50e2057d356e0dba65a0d5956463150f40a39830e2efe246a5b633dd6dc765f8ad75e75510e578240e58a5636f66e47a