Analysis

  • max time kernel
    64s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 06:27

General

  • Target

    test.exe

  • Size

    3.1MB

  • MD5

    051bfba0c640694d241f6b3621e241b6

  • SHA1

    a5269b7485203914af50cb932d952c10440878c9

  • SHA256

    854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09

  • SHA512

    bdfea5dfca423c4d66de1c9f435a1c0403b8615a0b7627fff665876fa2da48e8914cc2961ca9e66b7d32d2bc4004354e5e932297a479fcc90d495327d14577dc

  • SSDEEP

    49152:AvKgo2QSaNpzyPllgamb0CZof/JDj5RbR4jRoGdMOAuTHHB72eh2NT:Avjo2QSaNpzyPllgamYCZof/JDj5wFc

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SGVP

C2

192.168.1.9:4782

150.129.206.176:4782

Ai-Sgvp-33452.portmap.host:33452

Mutex

2464c7bf-a165-4397-85fe-def5290750b0

Attributes
  • encryption_key

    09BBDA8FF0524296F02F8F81158F33C0AA74D487

  • install_name

    User Application Data.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windowns Client Startup

  • subdirectory

    Quasar

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\test.exe
    "C:\Users\Admin\AppData\Local\Temp\test.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Windowns Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Quasar\User Application Data.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:2772
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\glbNIdmvSguU.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1324
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2640
        • C:\Users\Admin\AppData\Local\Temp\test.exe
          "C:\Users\Admin\AppData\Local\Temp\test.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn "Windowns Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Quasar\User Application Data.exe" /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2356
          • C:\Windows\system32\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\3ZAM42PQ9ad5.bat" "
            4⤵
              PID:2376
              • C:\Windows\system32\chcp.com
                chcp 65001
                5⤵
                  PID:2128
                • C:\Windows\system32\PING.EXE
                  ping -n 10 localhost
                  5⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1440
                • C:\Users\Admin\AppData\Local\Temp\test.exe
                  "C:\Users\Admin\AppData\Local\Temp\test.exe"
                  5⤵
                    PID:2752
                    • C:\Windows\system32\schtasks.exe
                      "schtasks" /create /tn "Windowns Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Quasar\User Application Data.exe" /rl HIGHEST /f
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1376

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\3ZAM42PQ9ad5.bat

            Filesize

            201B

            MD5

            0cb0b0381bcec284a65aa7da889a4d29

            SHA1

            8fe561c5f6cd4281d955ecb881d68d8f7d084806

            SHA256

            b317e8cbfbf0d0abcf4fc1f32a4dd52d651c74dda92388c86aaaafb7a3ba42b8

            SHA512

            13e8f61c5b30bdc3b95a2fd7d8c28b4917981acc28901002d99b119a705201b27272f88f9709b73365dcd9fc9eb4989710c71c071b377ac69d5a8a25a8e58601

          • C:\Users\Admin\AppData\Local\Temp\glbNIdmvSguU.bat

            Filesize

            201B

            MD5

            a6f12e0ea3c8305dcb1a7e7540b5fa9d

            SHA1

            2d340c8b796f99debd6a728b74fec2857b54b813

            SHA256

            a9cc890f5a41b333352fe3e24132971a4cf02064cbe3290fdae72b172a7cfce7

            SHA512

            75b5574d3de8b503a8163982a35f6fdadb7b7545bf6d68f3ba3e127f0e9da8830c47ea6cdff3251c6d8dbd1816c1d246da5cb378f5c3d1560f5f1d992020cd4c

          • memory/1304-15-0x0000000000CB0000-0x0000000000FD4000-memory.dmp

            Filesize

            3.1MB

          • memory/2752-25-0x0000000000090000-0x00000000003B4000-memory.dmp

            Filesize

            3.1MB

          • memory/2884-0-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

            Filesize

            4KB

          • memory/2884-1-0x0000000000AB0000-0x0000000000DD4000-memory.dmp

            Filesize

            3.1MB

          • memory/2884-2-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

            Filesize

            9.9MB

          • memory/2884-3-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

            Filesize

            4KB

          • memory/2884-4-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

            Filesize

            9.9MB

          • memory/2884-14-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

            Filesize

            9.9MB