Analysis

  • max time kernel
    76s
  • max time network
    73s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-12-2024 07:24

General

  • Target

    emmasBackdoor.exe

  • Size

    2.9MB

  • MD5

    0266f80fe6efd3e3e4bd0363d17bcbde

  • SHA1

    b144914eb53d2e35e410be64d2db052d06d680df

  • SHA256

    6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

  • SHA512

    21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8

  • SSDEEP

    49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

rath3r.xyz:4782

Mutex

7126373e-e872-4f94-bbbb-42e88d57137b

Attributes
  • encryption_key

    4DC093FC202D016F95DCEE92AAF2874F56ACC3F2

  • install_name

    Windows.WARP.JITService.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    MicrosoftUpdateTaskMachineCore

  • subdirectory

    ice

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 19 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe
    "C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Local\Temp\is-1A2D2.tmp\emmasBackdoor.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1A2D2.tmp\emmasBackdoor.tmp" /SL5="$12004C,1909968,965632,C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-M10DA.tmp\disable_defender.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4184
      • C:\Program Files (x86)\EmmasBackdoor\Client.exe
        "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3592
        • C:\Windows\SYSTEM32\schtasks.exe
          "schtasks" /create /tn "MicrosoftUpdateTaskMachineCore" /sc ONLOGON /tr "C:\Windows\system32\ice\Windows.WARP.JITService.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5080
        • C:\Windows\system32\ice\Windows.WARP.JITService.exe
          "C:\Windows\system32\ice\Windows.WARP.JITService.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1072
          • C:\Windows\SYSTEM32\schtasks.exe
            "schtasks" /create /tn "MicrosoftUpdateTaskMachineCore" /sc ONLOGON /tr "C:\Windows\system32\ice\Windows.WARP.JITService.exe" /rl HIGHEST /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2432
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2336
    • C:\Program Files (x86)\EmmasBackdoor\Client.exe
      "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\EmmasBackdoor\Client.exe

      Filesize

      3.1MB

      MD5

      66ebe604ddf4d6ab60a183f515536528

      SHA1

      278782873ae0a5cac94add051edfc12e223be55c

      SHA256

      37e733731381c02941e4a8da30350cf968532d08012b6bb91e525241e8ee2c86

      SHA512

      756de51b5f6116640736f7dd37faf6172db79c8eaf8da17ba1e3d788d5c0179a01746f7d30044ca5c535c1b3d938bfde3e5d810b7fe50815030be8a5288c2bf9

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

      Filesize

      1KB

      MD5

      baf55b95da4a601229647f25dad12878

      SHA1

      abc16954ebfd213733c4493fc1910164d825cac8

      SHA256

      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

      SHA512

      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v4io2jwx.cbw.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\is-1A2D2.tmp\emmasBackdoor.tmp

      Filesize

      3.3MB

      MD5

      95c49a50069cf27284ac7b186df5aae0

      SHA1

      4120193848e7726aac277f9ea6e4b3670342ed03

      SHA256

      9f62b6f4c234ded050162b55a9c6de0c604578dee34462b96615e48169a485bb

      SHA512

      f6d3fd7454943aac838cd81e17c35787747185e0736823424453ffbf375da1e921dba0a5ce88a05f7a71e2ac367d47ee8fbabbd529f48997b99f1a3afa5370cd

    • C:\Users\Admin\AppData\Local\Temp\is-M10DA.tmp\disable_defender.ps1

      Filesize

      544B

      MD5

      3568227fbb730d48fa31d13e87f9a370

      SHA1

      83ac8fbb2b9c35337f372977fe3323f63060c5ff

      SHA256

      a06e1c77a4ab2a13f90dc2f86bbb4cb662f2bd10b1f805b1b7745af4c2ad3698

      SHA512

      2b8863dbdc4c980eac867e600ca008261d046a99bf40cfc02a350ec45a04e3a7b958b21219ad0a26b339336f779ba167aa84c45dbe4d9d9ada004c4515ba6d17

    • memory/388-81-0x00000000009D0000-0x0000000000ACA000-memory.dmp

      Filesize

      1000KB

    • memory/388-2-0x00000000009D1000-0x0000000000A79000-memory.dmp

      Filesize

      672KB

    • memory/388-60-0x00000000009D0000-0x0000000000ACA000-memory.dmp

      Filesize

      1000KB

    • memory/388-0-0x00000000009D0000-0x0000000000ACA000-memory.dmp

      Filesize

      1000KB

    • memory/1072-89-0x000000001CBB0000-0x000000001D0D8000-memory.dmp

      Filesize

      5.2MB

    • memory/1072-88-0x000000001C3C0000-0x000000001C472000-memory.dmp

      Filesize

      712KB

    • memory/1072-87-0x000000001BBB0000-0x000000001BC00000-memory.dmp

      Filesize

      320KB

    • memory/3592-77-0x00000000000F0000-0x0000000000414000-memory.dmp

      Filesize

      3.1MB

    • memory/4184-44-0x0000000073CD0000-0x0000000074480000-memory.dmp

      Filesize

      7.7MB

    • memory/4184-52-0x0000000007190000-0x00000000071AA000-memory.dmp

      Filesize

      104KB

    • memory/4184-28-0x0000000005B50000-0x0000000005B9C000-memory.dmp

      Filesize

      304KB

    • memory/4184-22-0x00000000054F0000-0x0000000005844000-memory.dmp

      Filesize

      3.3MB

    • memory/4184-30-0x0000000006100000-0x0000000006132000-memory.dmp

      Filesize

      200KB

    • memory/4184-33-0x0000000073CD0000-0x0000000074480000-memory.dmp

      Filesize

      7.7MB

    • memory/4184-31-0x000000006FAF0000-0x000000006FB3C000-memory.dmp

      Filesize

      304KB

    • memory/4184-42-0x00000000060A0000-0x00000000060BE000-memory.dmp

      Filesize

      120KB

    • memory/4184-43-0x0000000006D10000-0x0000000006DB3000-memory.dmp

      Filesize

      652KB

    • memory/4184-16-0x0000000005400000-0x0000000005466000-memory.dmp

      Filesize

      408KB

    • memory/4184-45-0x0000000007490000-0x0000000007B0A000-memory.dmp

      Filesize

      6.5MB

    • memory/4184-46-0x0000000006E60000-0x0000000006E7A000-memory.dmp

      Filesize

      104KB

    • memory/4184-47-0x0000000006EB0000-0x0000000006EBA000-memory.dmp

      Filesize

      40KB

    • memory/4184-48-0x00000000070D0000-0x0000000007166000-memory.dmp

      Filesize

      600KB

    • memory/4184-49-0x0000000007040000-0x0000000007051000-memory.dmp

      Filesize

      68KB

    • memory/4184-50-0x0000000007070000-0x000000000707E000-memory.dmp

      Filesize

      56KB

    • memory/4184-51-0x0000000007080000-0x0000000007094000-memory.dmp

      Filesize

      80KB

    • memory/4184-27-0x0000000005B20000-0x0000000005B3E000-memory.dmp

      Filesize

      120KB

    • memory/4184-53-0x00000000070C0000-0x00000000070C8000-memory.dmp

      Filesize

      32KB

    • memory/4184-54-0x00000000071D0000-0x00000000071F2000-memory.dmp

      Filesize

      136KB

    • memory/4184-55-0x00000000080C0000-0x0000000008664000-memory.dmp

      Filesize

      5.6MB

    • memory/4184-58-0x0000000073CD0000-0x0000000074480000-memory.dmp

      Filesize

      7.7MB

    • memory/4184-9-0x0000000073CDE000-0x0000000073CDF000-memory.dmp

      Filesize

      4KB

    • memory/4184-15-0x0000000005390000-0x00000000053F6000-memory.dmp

      Filesize

      408KB

    • memory/4184-10-0x0000000004560000-0x0000000004596000-memory.dmp

      Filesize

      216KB

    • memory/4184-14-0x0000000004B70000-0x0000000004B92000-memory.dmp

      Filesize

      136KB

    • memory/4184-13-0x0000000073CD0000-0x0000000074480000-memory.dmp

      Filesize

      7.7MB

    • memory/4184-12-0x0000000073CD0000-0x0000000074480000-memory.dmp

      Filesize

      7.7MB

    • memory/4184-11-0x0000000004CF0000-0x0000000005318000-memory.dmp

      Filesize

      6.2MB

    • memory/4324-80-0x0000000000130000-0x0000000000489000-memory.dmp

      Filesize

      3.3MB

    • memory/4324-61-0x0000000000130000-0x0000000000489000-memory.dmp

      Filesize

      3.3MB

    • memory/4324-59-0x0000000001240000-0x0000000001241000-memory.dmp

      Filesize

      4KB

    • memory/4324-6-0x0000000001240000-0x0000000001241000-memory.dmp

      Filesize

      4KB