Analysis

  • max time kernel
    127s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 06:41

General

  • Target

    jerniuiopu.exe

  • Size

    288KB

  • MD5

    d0d7ce7681200387de77c7ab2e2841cd

  • SHA1

    8b6c4315e260954b6c33f450ad3baa9f79fe72e2

  • SHA256

    b64b141eb3b3fa67f6605eb99b0e6f78eb5df7d483a2a0889821ccfac71a7a96

  • SHA512

    bc3cfac3450cbc17ce8c9758f10c7e4034764f40a6797edd4a8eb6e95d6db9c5f46a46487a6e483ef0eed23243e9f92c0ea391a0416ebbc6854e2b9914ad9788

  • SSDEEP

    6144:w7zO0LSclT6FOwEP5Kq+SMv0VGb7bDcllbk9n:OlJtTF9zVGkllbkh

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

C2

82.117.243.110:5173

Mutex

yfsS9ida0wX8mgpdJC

Attributes
  • encryption_key

    KDNBgA8jiBeGX1rj1dDt

  • install_name

    csrss.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    NET framework

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jerniuiopu.exe
    "C:\Users\Admin\AppData\Local\Temp\jerniuiopu.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\jerniuiopu.exe" /rl HIGHEST /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3012-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

    Filesize

    4KB

  • memory/3012-1-0x0000000000DB0000-0x0000000000DFE000-memory.dmp

    Filesize

    312KB

  • memory/3012-2-0x0000000073F90000-0x000000007467E000-memory.dmp

    Filesize

    6.9MB

  • memory/3012-4-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

    Filesize

    4KB

  • memory/3012-5-0x0000000073F90000-0x000000007467E000-memory.dmp

    Filesize

    6.9MB