Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/12/2024, 04:02

General

  • Target

    ff7b72753ea2b80b03ad5275cc0987114997cc6ca55d81698fc679f7d35551f0.exe

  • Size

    42.8MB

  • MD5

    47a0c991d1dba2805305515d93b174db

  • SHA1

    dafffc1e5e242f125cee49200f4e094974a1ae71

  • SHA256

    ff7b72753ea2b80b03ad5275cc0987114997cc6ca55d81698fc679f7d35551f0

  • SHA512

    092c9cd414760f35d41f5c07bca3535edbb7048485d6bd87a35cf88c05e51fc30e12d6cec3ee86ce46e4abdc89354be1fda145ed7b04c85955204a302512ea84

  • SSDEEP

    393216:L76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfInVQx4urYsANulL7NF:L0LoCOn+2Is4urYDNulLBiuh

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Tools

C2

81.17.96.75:63009

Mutex

60b20d0a-a0cd-4b27-a870-970b6c27e2bc

Attributes
  • encryption_key

    94C6FF9C4A9CE8C5D400630879382E5892756A94

  • install_name

    Tools.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Tools

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff7b72753ea2b80b03ad5275cc0987114997cc6ca55d81698fc679f7d35551f0.exe
    "C:\Users\Admin\AppData\Local\Temp\ff7b72753ea2b80b03ad5275cc0987114997cc6ca55d81698fc679f7d35551f0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\a7a615cecdc7531620df291bc71a26e4\Tools.exe
      C:\Users\Admin\AppData\Local\Temp\a7a615cecdc7531620df291bc71a26e4\Tools.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        3⤵
          PID:2636
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5052
          • C:\Windows\SysWOW64\schtasks.exe
            "schtasks" /create /tn "Tools" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Tools.exe" /rl HIGHEST /f
            4⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:636

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\a7a615cecdc7531620df291bc71a26e4\Tools.exe

      Filesize

      33KB

      MD5

      d5e7ca586d423e46e5718d13679eef7c

      SHA1

      25357313d641c8472633eda9f056be7c0ae0b948

      SHA256

      3bdcd9ca8cb9f31b8c4f280cf75129e330e124604aeb64e3f81822393b1e5a0d

      SHA512

      b09b1e9d938cd9944182c8d9feaf69eb2dd284f39092ccb010fc0ac4b97598fe75a11b5b20d71d937494f092695cd642db78436050e2e5b64ec0c05e3deff335

    • C:\Users\Admin\AppData\Local\Temp\a7a615cecdc7531620df291bc71a26e4\VCRUNTIME140.dll

      Filesize

      115KB

      MD5

      f11e77313700cc647ab6fafb0e0254eb

      SHA1

      9950320220ae5fbb90619bd420a6546d8e529db6

      SHA256

      bd38963624cc1cd5cc6642bb0ef2b37ae02b0557f115c9ef5df2a00132389962

      SHA512

      60be8450ac60bf4256507988adc9025f0b4acf78bd56bc270dc4cbc03cafb3a0e6d64d29ee3c346212a9920c0d1279986cefe0ba2689312809550d184743a16c

    • C:\Users\Admin\AppData\Local\Temp\a7a615cecdc7531620df291bc71a26e4\concrt140e.dll

      Filesize

      3.1MB

      MD5

      8084c506c5d9a502c94e983765730ba2

      SHA1

      006292f837e03113094e45e16bfeee1d360239df

      SHA256

      b8a89b5d8715c3cbd56b76f9c9ad01154b69b2e8f1f0d2d42fdb29c8960812a2

      SHA512

      eab2ed81632869d5cb8e179a8fc206e1d3d567c61f6d1438a582414a2cd9f0e40fc8c5ee8d4ab4d3434dcc8aa3e1f4b9fa5b0e9b0d98f5a36abbb92e8f713294

    • C:\Users\Admin\AppData\Local\Temp\a7a615cecdc7531620df291bc71a26e4\jli.dll

      Filesize

      1.5MB

      MD5

      b288e2799a6aa020057ab8c9b203bfa6

      SHA1

      785737e76df95e112ef0a3166d61488993eaae58

      SHA256

      1c75498bb5c1db335f0a24afe8a55f84210d5feb3be401eab9c15ac911b96bbd

      SHA512

      d6bcbd275f609b6972c5d9bcfbe8e6b0085d9739b7c212663ff0c8e3c9b4fcab71fde4bac34d9bb5a8fe68f268a2abebd7414edaa454ebdc25dd233026738e19

    • memory/5052-34-0x0000000075160000-0x0000000075910000-memory.dmp

      Filesize

      7.7MB

    • memory/5052-37-0x0000000006050000-0x00000000060A0000-memory.dmp

      Filesize

      320KB

    • memory/5052-32-0x0000000005840000-0x0000000005DE4000-memory.dmp

      Filesize

      5.6MB

    • memory/5052-33-0x0000000005290000-0x0000000005322000-memory.dmp

      Filesize

      584KB

    • memory/5052-30-0x0000000000400000-0x0000000000724000-memory.dmp

      Filesize

      3.1MB

    • memory/5052-35-0x0000000005200000-0x000000000520A000-memory.dmp

      Filesize

      40KB

    • memory/5052-36-0x0000000006510000-0x0000000006B28000-memory.dmp

      Filesize

      6.1MB

    • memory/5052-31-0x000000007516E000-0x000000007516F000-memory.dmp

      Filesize

      4KB

    • memory/5052-38-0x00000000062C0000-0x0000000006372000-memory.dmp

      Filesize

      712KB

    • memory/5052-41-0x0000000007490000-0x00000000074A2000-memory.dmp

      Filesize

      72KB

    • memory/5052-42-0x00000000074F0000-0x000000000752C000-memory.dmp

      Filesize

      240KB

    • memory/5052-43-0x00000000075A0000-0x0000000007606000-memory.dmp

      Filesize

      408KB

    • memory/5052-44-0x000000007516E000-0x000000007516F000-memory.dmp

      Filesize

      4KB

    • memory/5052-45-0x0000000075160000-0x0000000075910000-memory.dmp

      Filesize

      7.7MB