Analysis

  • max time kernel
    68s
  • max time network
    73s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-12-2024 12:31

General

  • Target

    emmasBackdoor.exe

  • Size

    2.9MB

  • MD5

    0266f80fe6efd3e3e4bd0363d17bcbde

  • SHA1

    b144914eb53d2e35e410be64d2db052d06d680df

  • SHA256

    6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

  • SHA512

    21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8

  • SSDEEP

    49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

rath3r.xyz:4782

Mutex

7126373e-e872-4f94-bbbb-42e88d57137b

Attributes
  • encryption_key

    4DC093FC202D016F95DCEE92AAF2874F56ACC3F2

  • install_name

    Windows.WARP.JITService.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    MicrosoftUpdateTaskMachineCore

  • subdirectory

    ice

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 19 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe
    "C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Local\Temp\is-KB8FV.tmp\emmasBackdoor.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KB8FV.tmp\emmasBackdoor.tmp" /SL5="$70106,1909968,965632,C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3256
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-A9EHB.tmp\disable_defender.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4676
      • C:\Program Files (x86)\EmmasBackdoor\Client.exe
        "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "MicrosoftUpdateTaskMachineCore" /sc ONLOGON /tr "C:\Windows\system32\ice\Windows.WARP.JITService.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2876
        • C:\Windows\system32\ice\Windows.WARP.JITService.exe
          "C:\Windows\system32\ice\Windows.WARP.JITService.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "MicrosoftUpdateTaskMachineCore" /sc ONLOGON /tr "C:\Windows\system32\ice\Windows.WARP.JITService.exe" /rl HIGHEST /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1336
  • C:\Program Files (x86)\EmmasBackdoor\Client.exe
    "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:732
  • C:\Program Files (x86)\EmmasBackdoor\Client.exe
    "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3232
  • C:\Program Files (x86)\EmmasBackdoor\Client.exe
    "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1516
  • C:\Program Files (x86)\EmmasBackdoor\Client.exe
    "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\EmmasBackdoor\Client.exe

    Filesize

    3.1MB

    MD5

    66ebe604ddf4d6ab60a183f515536528

    SHA1

    278782873ae0a5cac94add051edfc12e223be55c

    SHA256

    37e733731381c02941e4a8da30350cf968532d08012b6bb91e525241e8ee2c86

    SHA512

    756de51b5f6116640736f7dd37faf6172db79c8eaf8da17ba1e3d788d5c0179a01746f7d30044ca5c535c1b3d938bfde3e5d810b7fe50815030be8a5288c2bf9

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

    Filesize

    1KB

    MD5

    b4e91d2e5f40d5e2586a86cf3bb4df24

    SHA1

    31920b3a41aa4400d4a0230a7622848789b38672

    SHA256

    5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

    SHA512

    968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opdy3exi.wp2.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\is-A9EHB.tmp\disable_defender.ps1

    Filesize

    544B

    MD5

    3568227fbb730d48fa31d13e87f9a370

    SHA1

    83ac8fbb2b9c35337f372977fe3323f63060c5ff

    SHA256

    a06e1c77a4ab2a13f90dc2f86bbb4cb662f2bd10b1f805b1b7745af4c2ad3698

    SHA512

    2b8863dbdc4c980eac867e600ca008261d046a99bf40cfc02a350ec45a04e3a7b958b21219ad0a26b339336f779ba167aa84c45dbe4d9d9ada004c4515ba6d17

  • C:\Users\Admin\AppData\Local\Temp\is-KB8FV.tmp\emmasBackdoor.tmp

    Filesize

    3.3MB

    MD5

    95c49a50069cf27284ac7b186df5aae0

    SHA1

    4120193848e7726aac277f9ea6e4b3670342ed03

    SHA256

    9f62b6f4c234ded050162b55a9c6de0c604578dee34462b96615e48169a485bb

    SHA512

    f6d3fd7454943aac838cd81e17c35787747185e0736823424453ffbf375da1e921dba0a5ce88a05f7a71e2ac367d47ee8fbabbd529f48997b99f1a3afa5370cd

  • memory/1016-76-0x0000000000350000-0x0000000000674000-memory.dmp

    Filesize

    3.1MB

  • memory/3164-86-0x000000001BE40000-0x000000001BE90000-memory.dmp

    Filesize

    320KB

  • memory/3164-87-0x000000001BF50000-0x000000001C002000-memory.dmp

    Filesize

    712KB

  • memory/3256-84-0x0000000000C70000-0x0000000000FC9000-memory.dmp

    Filesize

    3.3MB

  • memory/3256-6-0x0000000003270000-0x0000000003271000-memory.dmp

    Filesize

    4KB

  • memory/3256-60-0x0000000000C70000-0x0000000000FC9000-memory.dmp

    Filesize

    3.3MB

  • memory/3256-58-0x0000000003270000-0x0000000003271000-memory.dmp

    Filesize

    4KB

  • memory/4636-85-0x0000000000B70000-0x0000000000C6A000-memory.dmp

    Filesize

    1000KB

  • memory/4636-2-0x0000000000B71000-0x0000000000C19000-memory.dmp

    Filesize

    672KB

  • memory/4636-59-0x0000000000B70000-0x0000000000C6A000-memory.dmp

    Filesize

    1000KB

  • memory/4636-0-0x0000000000B70000-0x0000000000C6A000-memory.dmp

    Filesize

    1000KB

  • memory/4676-42-0x0000000007A90000-0x0000000007B34000-memory.dmp

    Filesize

    656KB

  • memory/4676-51-0x0000000007F10000-0x0000000007F2A000-memory.dmp

    Filesize

    104KB

  • memory/4676-36-0x0000000073F90000-0x0000000074741000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-29-0x0000000007840000-0x0000000007874000-memory.dmp

    Filesize

    208KB

  • memory/4676-40-0x0000000006E70000-0x0000000006E8E000-memory.dmp

    Filesize

    120KB

  • memory/4676-41-0x0000000073F90000-0x0000000074741000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-27-0x00000000068C0000-0x000000000690C000-memory.dmp

    Filesize

    304KB

  • memory/4676-43-0x0000000073F90000-0x0000000074741000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-44-0x0000000008270000-0x00000000088EA000-memory.dmp

    Filesize

    6.5MB

  • memory/4676-45-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

    Filesize

    104KB

  • memory/4676-46-0x0000000007C40000-0x0000000007C4A000-memory.dmp

    Filesize

    40KB

  • memory/4676-47-0x0000000007E70000-0x0000000007F06000-memory.dmp

    Filesize

    600KB

  • memory/4676-48-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

    Filesize

    68KB

  • memory/4676-49-0x0000000007E20000-0x0000000007E2E000-memory.dmp

    Filesize

    56KB

  • memory/4676-50-0x0000000007E30000-0x0000000007E45000-memory.dmp

    Filesize

    84KB

  • memory/4676-30-0x00000000701A0000-0x00000000701EC000-memory.dmp

    Filesize

    304KB

  • memory/4676-52-0x0000000007F30000-0x0000000007F38000-memory.dmp

    Filesize

    32KB

  • memory/4676-53-0x0000000007F60000-0x0000000007F82000-memory.dmp

    Filesize

    136KB

  • memory/4676-54-0x0000000008EA0000-0x0000000009446000-memory.dmp

    Filesize

    5.6MB

  • memory/4676-57-0x0000000073F90000-0x0000000074741000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-26-0x0000000006870000-0x000000000688E000-memory.dmp

    Filesize

    120KB

  • memory/4676-25-0x00000000063B0000-0x0000000006707000-memory.dmp

    Filesize

    3.3MB

  • memory/4676-16-0x0000000006340000-0x00000000063A6000-memory.dmp

    Filesize

    408KB

  • memory/4676-15-0x00000000061E0000-0x0000000006246000-memory.dmp

    Filesize

    408KB

  • memory/4676-14-0x00000000059D0000-0x00000000059F2000-memory.dmp

    Filesize

    136KB

  • memory/4676-13-0x0000000073F90000-0x0000000074741000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-11-0x0000000073F90000-0x0000000074741000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-12-0x0000000005BB0000-0x00000000061DA000-memory.dmp

    Filesize

    6.2MB

  • memory/4676-10-0x00000000053E0000-0x0000000005416000-memory.dmp

    Filesize

    216KB

  • memory/4676-9-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

    Filesize

    4KB