Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 03:34

General

  • Target

    UrMine2.exe

  • Size

    3.2MB

  • MD5

    7b9480d4a112833514e7bb79434ac910

  • SHA1

    9050db3991eaa8a2ab8d0485877f54e096660036

  • SHA256

    38fdd127d155587e46643e9ce269951ab8f3c41563437613dc5709aeadfceb32

  • SHA512

    125e94039981aa6072a352dddcc531f58cdc3d9db9bb0557c3ba1561fcd40b7d0fea76b06701ec7e53248c4c0e6ac607c7d8e71dfde0a0221abff9eaa006b693

  • SSDEEP

    98304:ZtiwNlunVqirIBmG9Li2JWrV2yM0SlNevauUaO/tCI:Zt9unlrIBT9LVJoV2yM0SlNevwC

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Axotrojan

C2

eu-central-7075.packetriot.net:22342

167.71.56.116:22342

Mutex

34892381-1dda-4b06-87a2-3e413b932ac8

Attributes
  • encryption_key

    4B13DC71783277444E966E1D66F9171ABFC15E88

  • install_name

    Clientformyslut.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Axo startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Modifies Windows Firewall 2 TTPs 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\UrMine2.exe
    "C:\Users\Admin\AppData\Local\Temp\UrMine2.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AdgBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAegBmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG0AcABiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAcQB1ACMAPgA="
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4372
    • C:\Users\Admin\AppData\Local\Temp\pkriot3.exe
      "C:\Users\Admin\AppData\Local\Temp\pkriot3.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:992
      • C:\Users\Admin\AppData\Local\Temp\server.exe
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1708
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe"
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3664
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3488
    • C:\Users\Admin\AppData\Local\Temp\pkriot1.exe
      "C:\Users\Admin\AppData\Local\Temp\pkriot1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Axo startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientformyslut.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1220
      • C:\Windows\system32\SubDir\Clientformyslut.exe
        "C:\Windows\system32\SubDir\Clientformyslut.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2228
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "Axo startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Clientformyslut.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3400
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:404
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3036

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llmqfubp.pjq.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\pkriot1.exe

      Filesize

      3.1MB

      MD5

      9a3043abedc95a0a1c5d4fdb50e62d34

      SHA1

      2f432259c81f112905e24016191a1186e4fbdc88

      SHA256

      18df830ce713c45edf04f76b23da7e5f1c57bcacd26b075ed94904da6bf94f74

      SHA512

      fb7f692b1b035d732a175b40760baacc6f7ccfa88ca26da0f74eda2fb542a9e10c47c1309b60caf7169cb7a9035e8e2083ed5e5c2bc4292c9ef5e1c85ecf7c1c

    • C:\Users\Admin\AppData\Local\Temp\pkriot3.exe

      Filesize

      93KB

      MD5

      55e2016fcb659bdf0f46a24ef2876609

      SHA1

      5afb69f26ddf1884372643a2b00d16a481fc7c26

      SHA256

      3825fe6fd9e8754b3d4a374b8c73884647c6898d5e1220a0fe89b1a3dc8e35c4

      SHA512

      4de0fb035b904bd2557d48aacfea53346748e0dbda86b710ee86796c374c37fd35e50f4d8b05cd1c058f95665894629f8848f4bce45378c00ced771baaea3e46

    • C:\Users\Admin\AppData\Roaming\app

      Filesize

      5B

      MD5

      c2844bc9e1bd64168a727b0680ae4d90

      SHA1

      7bb263540de557f5a4e09c6c78b7dbb314a0df9a

      SHA256

      9c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5

      SHA512

      360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed

    • memory/404-121-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-126-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-117-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-116-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-115-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-122-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-123-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-124-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-125-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/404-127-0x000001A4B60D0000-0x000001A4B60D1000-memory.dmp

      Filesize

      4KB

    • memory/992-21-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

      Filesize

      64KB

    • memory/992-22-0x0000000073352000-0x0000000073354000-memory.dmp

      Filesize

      8KB

    • memory/992-19-0x0000000073352000-0x0000000073353000-memory.dmp

      Filesize

      4KB

    • memory/2228-111-0x000000001E290000-0x000000001E7B8000-memory.dmp

      Filesize

      5.2MB

    • memory/2228-61-0x000000001B6C0000-0x000000001B710000-memory.dmp

      Filesize

      320KB

    • memory/2228-62-0x000000001D960000-0x000000001DA12000-memory.dmp

      Filesize

      712KB

    • memory/3556-24-0x00000000001B0000-0x00000000004D4000-memory.dmp

      Filesize

      3.1MB

    • memory/3556-25-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

      Filesize

      64KB

    • memory/3556-20-0x00007FFD14343000-0x00007FFD14345000-memory.dmp

      Filesize

      8KB

    • memory/4372-64-0x000000006E800000-0x000000006E84C000-memory.dmp

      Filesize

      304KB

    • memory/4372-74-0x0000000007190000-0x00000000071AE000-memory.dmp

      Filesize

      120KB

    • memory/4372-75-0x00000000071B0000-0x0000000007253000-memory.dmp

      Filesize

      652KB

    • memory/4372-76-0x0000000007920000-0x0000000007F9A000-memory.dmp

      Filesize

      6.5MB

    • memory/4372-77-0x00000000072D0000-0x00000000072EA000-memory.dmp

      Filesize

      104KB

    • memory/4372-78-0x0000000007340000-0x000000000734A000-memory.dmp

      Filesize

      40KB

    • memory/4372-79-0x0000000007560000-0x00000000075F6000-memory.dmp

      Filesize

      600KB

    • memory/4372-80-0x00000000074D0000-0x00000000074E1000-memory.dmp

      Filesize

      68KB

    • memory/4372-81-0x0000000007510000-0x000000000751E000-memory.dmp

      Filesize

      56KB

    • memory/4372-82-0x0000000007520000-0x0000000007534000-memory.dmp

      Filesize

      80KB

    • memory/4372-83-0x0000000007600000-0x000000000761A000-memory.dmp

      Filesize

      104KB

    • memory/4372-87-0x0000000007550000-0x0000000007558000-memory.dmp

      Filesize

      32KB

    • memory/4372-63-0x0000000006570000-0x00000000065A2000-memory.dmp

      Filesize

      200KB

    • memory/4372-49-0x0000000005FE0000-0x000000000602C000-memory.dmp

      Filesize

      304KB

    • memory/4372-48-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

      Filesize

      120KB

    • memory/4372-43-0x0000000005990000-0x0000000005CE4000-memory.dmp

      Filesize

      3.3MB

    • memory/4372-33-0x0000000005920000-0x0000000005986000-memory.dmp

      Filesize

      408KB

    • memory/4372-32-0x00000000058B0000-0x0000000005916000-memory.dmp

      Filesize

      408KB

    • memory/4372-31-0x0000000005010000-0x0000000005032000-memory.dmp

      Filesize

      136KB

    • memory/4372-28-0x0000000005150000-0x0000000005778000-memory.dmp

      Filesize

      6.2MB

    • memory/4372-26-0x0000000004B10000-0x0000000004B20000-memory.dmp

      Filesize

      64KB

    • memory/4372-27-0x00000000049E0000-0x0000000004A16000-memory.dmp

      Filesize

      216KB

    • memory/4372-23-0x0000000072B8E000-0x0000000072B8F000-memory.dmp

      Filesize

      4KB