Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

4c55655c8d...21.exe

windows7-x64

10

4c55655c8d...21.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 02:28 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521.exe

  • Size

    3.1MB

  • MD5

    5c585cd5a2d292a0cb0be6b10cace921

  • SHA1

    84b90137c36d741a4291aa22f4450c470ed9bd89

  • SHA256

    4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521

  • SHA512

    958c91d84c7e163fd473caf91363680347aa452aebdae76a4c01b39da790d003c20af6462bec3663c0208e8680ae2a9042fbc2c8ed8960e062dd51070fa39b27

  • SSDEEP

    49152:avCI22SsaNYfdPBldt698dBcjHQCv1JSpoGdTvTHHB72eh2NT:avP22SsaNYfdPBldt6+dBcjHQCa

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

tieumao1995-51127.portmap.io:51127

Mutex

4119a2e0-4ae4-4843-8534-99af91a2475d

Attributes
  • encryption_key

    DF6316067206E09C1F85138FCEBD56F5D94BF6AE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521.exe
    "C:\Users\Admin\AppData\Local\Temp\4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4004
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4592

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tieumao1995-51127.portmap.io
    Client.exe
    Remote address:
    8.8.8.8:53
    Request
    tieumao1995-51127.portmap.io
    IN A
    Response
    tieumao1995-51127.portmap.io
    IN A
    193.161.193.99
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 193.161.193.99:51127
    tieumao1995-51127.portmap.io
    Client.exe
    260 B
     200 B
     5
    5
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    21.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    21.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    tieumao1995-51127.portmap.io
    dns
    Client.exe
    74 B
     90 B
     1
    1

    DNS Request

    tieumao1995-51127.portmap.io

    DNS Response

    193.161.193.99

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    86.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    86.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    22.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    22.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    Filesize

    3.1MB

    MD5

    5c585cd5a2d292a0cb0be6b10cace921

    SHA1

    84b90137c36d741a4291aa22f4450c470ed9bd89

    SHA256

    4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521

    SHA512

    958c91d84c7e163fd473caf91363680347aa452aebdae76a4c01b39da790d003c20af6462bec3663c0208e8680ae2a9042fbc2c8ed8960e062dd51070fa39b27

    Download Submit

  • memory/3152-0-0x00007FF8563B3000-0x00007FF8563B5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3152-1-0x00000000003D0000-0x00000000006F6000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/3152-2-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3152-9-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3340-8-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3340-10-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3340-11-0x000000001B930000-0x000000001B980000-memory.dmp

    Filesize

    320KB

    Download

  • memory/3340-12-0x000000001C290000-0x000000001C342000-memory.dmp

    Filesize

    712KB

    Download

  • memory/3340-13-0x00007FF8563B0000-0x00007FF856E71000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.