Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 03:02

General

  • Target

    854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe

  • Size

    3.1MB

  • MD5

    051bfba0c640694d241f6b3621e241b6

  • SHA1

    a5269b7485203914af50cb932d952c10440878c9

  • SHA256

    854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09

  • SHA512

    bdfea5dfca423c4d66de1c9f435a1c0403b8615a0b7627fff665876fa2da48e8914cc2961ca9e66b7d32d2bc4004354e5e932297a479fcc90d495327d14577dc

  • SSDEEP

    49152:AvKgo2QSaNpzyPllgamb0CZof/JDj5RbR4jRoGdMOAuTHHB72eh2NT:Avjo2QSaNpzyPllgamYCZof/JDj5wFc

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SGVP

C2

192.168.1.9:4782

150.129.206.176:4782

Ai-Sgvp-33452.portmap.host:33452

Mutex

2464c7bf-a165-4397-85fe-def5290750b0

Attributes
  • encryption_key

    09BBDA8FF0524296F02F8F81158F33C0AA74D487

  • install_name

    User Application Data.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windowns Client Startup

  • subdirectory

    Quasar

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe
    "C:\Users\Admin\AppData\Local\Temp\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windowns Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Quasar\User Application Data.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:460
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\02QN40gPHsgZ.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3264
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2684
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:636
        • C:\Users\Admin\AppData\Local\Temp\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe
          "C:\Users\Admin\AppData\Local\Temp\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1592
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "Windowns Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Quasar\User Application Data.exe" /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1608
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\swkuflxV6wsq.bat" "
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:224
            • C:\Windows\system32\chcp.com
              chcp 65001
              5⤵
                PID:4564
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                5⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:4284
              • C:\Users\Admin\AppData\Local\Temp\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe
                "C:\Users\Admin\AppData\Local\Temp\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe"
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4376
                • C:\Windows\SYSTEM32\schtasks.exe
                  "schtasks" /create /tn "Windowns Client Startup" /sc ONLOGON /tr "C:\Windows\system32\Quasar\User Application Data.exe" /rl HIGHEST /f
                  6⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3380

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\854fc659414fc88605337694eb6b6f4f177389c9cbb69ca0b0e705f555ebbb09.exe.log

        Filesize

        2KB

        MD5

        8f0271a63446aef01cf2bfc7b7c7976b

        SHA1

        b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

        SHA256

        da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

        SHA512

        78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

      • C:\Users\Admin\AppData\Local\Temp\02QN40gPHsgZ.bat

        Filesize

        261B

        MD5

        37b4b939e97c47948e2c24085727ae25

        SHA1

        885f7a6f068af8b8a9ba537101e717bf1413ce7d

        SHA256

        9fde3fb0e400bc15ee088f871d0028f899a3aa275307dfc4b11b899ab756d9ad

        SHA512

        b034c3f0f7b72e487748305d82a63ead32da1170dbdfe29d603e48d875ef41603576ad1e11d527b618719d9d4dde050daeaefb8710d3ebe849f772a55e8f908f

      • C:\Users\Admin\AppData\Local\Temp\swkuflxV6wsq.bat

        Filesize

        261B

        MD5

        52a3d6fdc95353d18b7ba25c84e9d3cb

        SHA1

        892ea226b34d3130d035211a2fba63707931a63f

        SHA256

        839dd6cbdd127eb4fec8bf5abcafe89b7d4f12ff7233447aac424541bd890779

        SHA512

        cd67c2bbc5caf673865d6ec6a427a19348680a773773f307e0cc19bf603b6aaddd30202dc81ce8465ee7bdfb8d2508f312308cb82c815833b604c2c1015a2448

      • memory/2208-0-0x00007FFD47823000-0x00007FFD47825000-memory.dmp

        Filesize

        8KB

      • memory/2208-1-0x0000000000240000-0x0000000000564000-memory.dmp

        Filesize

        3.1MB

      • memory/2208-2-0x00007FFD47820000-0x00007FFD482E1000-memory.dmp

        Filesize

        10.8MB

      • memory/2208-3-0x000000001B1D0000-0x000000001B220000-memory.dmp

        Filesize

        320KB

      • memory/2208-4-0x000000001D2F0000-0x000000001D3A2000-memory.dmp

        Filesize

        712KB

      • memory/2208-5-0x00007FFD47823000-0x00007FFD47825000-memory.dmp

        Filesize

        8KB

      • memory/2208-6-0x00007FFD47820000-0x00007FFD482E1000-memory.dmp

        Filesize

        10.8MB

      • memory/2208-11-0x00007FFD47820000-0x00007FFD482E1000-memory.dmp

        Filesize

        10.8MB