Analysis

  • max time kernel
    28s
  • max time network
    33s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    15-12-2024 16:28

General

  • Target

    Panel Ejecutador MTA 3.14.zip

  • Size

    1.1MB

  • MD5

    d345c2eb24b0d3806865fda604ad1cc8

  • SHA1

    6b813317f6108f2c242babda58097070503df242

  • SHA256

    9261f3eefa0aef107e865784d8b8b62d4e7213056dfe535893920a344fa0d908

  • SHA512

    76c941b833ffcef6da121c2e2735952ed81cbf7c6a6260a227040d37abf0adaa41461045c69710331345d52d95aac89ddf0a256ebc85fbdb2ed703106999ab74

  • SSDEEP

    24576:ioRau4l48JTUIlfSsqFDxCs3+UgQYuX370FBZa:ioRUv5UIYsqOs3+UPY234m

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

azxq0ap.localto.net:3425

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    WindowsUpdate.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsUpdate

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Panel Ejecutador MTA 3.14.zip"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3724
  • C:\Users\Admin\Desktop\Panel Ejecutador MTA 3.14.exe
    "C:\Users\Admin\Desktop\Panel Ejecutador MTA 3.14.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:728
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4400
    • C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "WindowsUpdate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\WindowsUpdate.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3948
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffc05b0cc40,0x7ffc05b0cc4c,0x7ffc05b0cc58
      2⤵
        PID:4316
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2032,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2024 /prefetch:2
        2⤵
          PID:2208
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2072 /prefetch:3
          2⤵
            PID:3812
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2272,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2284 /prefetch:8
            2⤵
              PID:2072
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3176 /prefetch:1
              2⤵
                PID:1300
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3216 /prefetch:1
                2⤵
                  PID:824
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4528 /prefetch:1
                  2⤵
                    PID:4576
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4676,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4668 /prefetch:8
                    2⤵
                      PID:1100
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
                      2⤵
                      • Drops file in Windows directory
                      PID:392
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7c0254698,0x7ff7c02546a4,0x7ff7c02546b0
                        3⤵
                        • Drops file in Windows directory
                        PID:4512
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4648,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4868 /prefetch:1
                      2⤵
                        PID:764
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4468 /prefetch:8
                        2⤵
                          PID:1064
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3732,i,15488973921766851979,11018467518071966244,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5160 /prefetch:1
                          2⤵
                            PID:3288
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:2468
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:2968

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6da0b9bd-15fd-43cd-aeef-83caa8858736.tmp

                              Filesize

                              233KB

                              MD5

                              05521b5a80df7442b8164f4a3db6dec2

                              SHA1

                              c5a4c10c857c3c3407784be0575345f9ecec3130

                              SHA256

                              1859024d542670623ee7ca3b9053f58442ddb9c5cb9f2677becf3ab3daac09d4

                              SHA512

                              5ac05f3b351e9829d0d9a0c021bb5e1186e0a09446132bba859c7671eddc4d42bc31de6af7d4b34299d065ec440e4a703bfdf174bd470ecad1fe0b9088a67c2d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              3422eaa91e9e308745d85b89d7862c83

                              SHA1

                              f65c81fd6a138cf769cbc4ff8c3e2d3a1d3a4925

                              SHA256

                              f4a083d3f05cc70b2c408623389c24e1f0ca17a1670986bc138b460e93bf7715

                              SHA512

                              075a233f69578a26d9bc9d45273eb9b6794cf1b55a5e13cb89905e7b1475f797ab20c252b225fe8b9aecfd4074fbbc16c020d345645e058a52428a1651a05543

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              356B

                              MD5

                              9d15b49f3c2c190615050c6b01942a09

                              SHA1

                              0f96d456938d12c86673ad8221974709033fd8fe

                              SHA256

                              6f86e5b20a2c606bd72994d79ed2f708c58485509fc13b8b27acec78112a1df8

                              SHA512

                              1a80c2f1ba2b1cade8828351f0902724a13b6bb4f29c67b82ed708021aaff3f04fa20763f028456c3bd0eca91e76670abcf24fb9fa51ce3520cc764356ef7107

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              fd46026960eb30b34a1732509403f6e9

                              SHA1

                              1a47d40fcb3ea9e374df151a8ff802cd45a09537

                              SHA256

                              fcc65737de39826a3662114b1fd675a23ace50af970ba44f3b4390784dd2149b

                              SHA512

                              df253b694bb2bd9c6249ca0f3bd6574d22f28c4b47fa23278616cc937dcb9cbadc0ad62482d653d7dee79cef8d26b95bf051d95a035ca01bc3eafe22bb41eca3

                            • C:\Users\Admin\Desktop\Panel Ejecutador MTA 3.14.exe

                              Filesize

                              3.3MB

                              MD5

                              5791d405ca0a97a89eeaeb4f2be628be

                              SHA1

                              a012d40aaaa01db12a83b0e4408d012fd383dd0b

                              SHA256

                              6c67a1bf1d558b31a790e4bdcef062c9b49f00a1b3d7361dfc8308d55b87bc5d

                              SHA512

                              3971447d6a5f1ffe51bb1acc0d2525aa5bca521358c67828e6bd983d68e8c22dfa83ab49109575bc113e13de861682af563a3ed21e5ef48cce1bfcdb8f1f2afd

                            • memory/728-5-0x0000000000780000-0x0000000000AD6000-memory.dmp

                              Filesize

                              3.3MB

                            • memory/728-9-0x00007FFC0C680000-0x00007FFC0D142000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/728-4-0x00007FFC0C683000-0x00007FFC0C685000-memory.dmp

                              Filesize

                              8KB

                            • memory/728-6-0x00007FFC0C680000-0x00007FFC0D142000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/3652-11-0x000000001CAC0000-0x000000001CB72000-memory.dmp

                              Filesize

                              712KB

                            • memory/3652-46-0x000000001D1C0000-0x000000001D1FC000-memory.dmp

                              Filesize

                              240KB

                            • memory/3652-45-0x000000001CA40000-0x000000001CA52000-memory.dmp

                              Filesize

                              72KB

                            • memory/3652-36-0x000000001D2B0000-0x000000001D7D8000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/3652-10-0x000000001C9B0000-0x000000001CA00000-memory.dmp

                              Filesize

                              320KB