Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2024 09:38

General

  • Target

    FortniteExternal.exe

  • Size

    37KB

  • MD5

    ba116c70830d49029c03acbb2f2fac1b

  • SHA1

    ec5de491b7910e25b5bfb7e8803b30186b38a71d

  • SHA256

    96391e7351eeec459e219aa35afd521e528eca4bf32d0aaf4ff018392c4894e3

  • SHA512

    768328944e44f88fc116376045b934ab251362ea41349ce0c4b968abbb09ce6a3060d70cd75344acb72b6db8c51c164dcf56ac3279ca2e1608bbbbc65b09c410

  • SSDEEP

    384:aLi12fprueXnMnUNGNlrFV5ga0gEVjIMDYf4/ERnvawR6KhzVcQSgafw2IwrWGcp:+Im6nUjIMDPEJ5h3X2rjmeCt070H7

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Runtime Broker

C2

92.221.125.55:49868

Mutex

73f0bf3a-83f3-424b-b7a1-a8200df3e317

Attributes
  • encryption_key

    5CB2755608EFDB1313EF4F2ACEA101833F5AEE2B

  • install_name

    Runtime Broker.exe

  • log_directory

    Logs

  • reconnect_delay

    100

  • startup_key

    System

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 10 IoCs
  • Drops file in System32 directory 11 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\FortniteExternal.exe
    "C:\Users\Admin\AppData\Local\Temp\FortniteExternal.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /f /tn "System64_Telecom" /tr "C:\Windows\system32\System64_Telecom.exe" /sc onlogon /rl highest >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /tn "System64_Telecom" /tr "C:\Windows\system32\System64_Telecom.exe" /sc onlogon /rl highest
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2880
    • C:\Users\Admin\Documents\System64Service.exe
      "C:\Users\Admin\Documents\System64Service.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f > nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\system32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\PushNotifications /v ToastEnabled /t REG_DWORD /d 0 /f
          4⤵
          • Modifies registry key
          PID:2640
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f > nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\system32\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f
          4⤵
          • Modifies registry key
          PID:2344
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Policies\Microsoft\Windows\Explorer /v DisableNotificationCenter /t REG_DWORD /d 1 /f > nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Windows\system32\reg.exe
          reg add HKCU\Software\Policies\Microsoft\Windows\Explorer /v DisableNotificationCenter /t REG_DWORD /d 1 /f
          4⤵
          • Modifies registry key
          PID:2160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Updateservices64" >nul 2>&1
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\system32\schtasks.exe
          schtasks /query /tn "Windows_Updateservices64"
          4⤵
            PID:1652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Updateservices64" >nul 2>&1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:372
          • C:\Windows\system32\schtasks.exe
            schtasks /query /tn "Windows_Updateservices64"
            4⤵
              PID:676
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /f /tn "Windows_Updateservices64" /tr "C:\windows\system32\Windows_Updateservices64.exe" /sc onlogon /rl highest >nul 2>&1
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1316
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /tn "Windows_Updateservices64" /tr "C:\windows\system32\Windows_Updateservices64.exe" /sc onlogon /rl highest
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3056
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Systemservices64" >nul 2>&1
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2940
            • C:\Windows\system32\schtasks.exe
              schtasks /query /tn "Windows_Systemservices64"
              4⤵
                PID:1092
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /query /tn "Windows_Systemservices64" >nul 2>&1
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Windows\system32\schtasks.exe
                schtasks /query /tn "Windows_Systemservices64"
                4⤵
                  PID:2924
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /f /tn "Windows_Systemservices64" /tr "C:\windows\system32\Windows_Systemservices64.exe" /sc onlogon /rl highest >nul 2>&1
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3036
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /f /tn "Windows_Systemservices64" /tr "C:\windows\system32\Windows_Systemservices64.exe" /sc onlogon /rl highest
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2016
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /query /tn "System32HealthMonitor" >nul 2>&1
                3⤵
                  PID:1200
                  • C:\Windows\system32\schtasks.exe
                    schtasks /query /tn "System32HealthMonitor"
                    4⤵
                      PID:2116
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c schtasks /query /tn "System32HealthMonitor" >nul 2>&1
                    3⤵
                      PID:840
                      • C:\Windows\system32\schtasks.exe
                        schtasks /query /tn "System32HealthMonitor"
                        4⤵
                          PID:1772
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /create /f /tn "System32HealthMonitor" /tr "C:\windows\system32\System32HealthMonitor.exe" /sc onlogon /rl highest >nul 2>&1
                        3⤵
                          PID:2120
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /tn "System32HealthMonitor" /tr "C:\windows\system32\System32HealthMonitor.exe" /sc onlogon /rl highest
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:780
                        • C:\windows\system32\Windows_Updateservices64.exe
                          C:\windows\system32\Windows_Updateservices64.exe
                          3⤵
                          • Executes dropped EXE
                          PID:1032
                          • C:\windows\system32\Windows_Updateservices64.exe
                            C:\windows\system32\Windows_Updateservices64.exe
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2436
                        • C:\windows\system32\Windows_Systemservices64.exe
                          C:\windows\system32\Windows_Systemservices64.exe
                          3⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1976
                          • C:\windows\system32\schtasks.exe
                            "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Runtime Broker.exe" /rl HIGHEST /f
                            4⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:984
                          • C:\Windows\system32\SubDir\Runtime Broker.exe
                            "C:\Windows\system32\SubDir\Runtime Broker.exe"
                            4⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:1844
                            • C:\Windows\system32\schtasks.exe
                              "schtasks" /create /tn "System" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Runtime Broker.exe" /rl HIGHEST /f
                              5⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:1784

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                      Filesize

                      1KB

                      MD5

                      67e486b2f148a3fca863728242b6273e

                      SHA1

                      452a84c183d7ea5b7c015b597e94af8eef66d44a

                      SHA256

                      facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                      SHA512

                      d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

                      Filesize

                      436B

                      MD5

                      971c514f84bba0785f80aa1c23edfd79

                      SHA1

                      732acea710a87530c6b08ecdf32a110d254a54c8

                      SHA256

                      f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                      SHA512

                      43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

                      Filesize

                      174B

                      MD5

                      252dedc21006198a70f5a0df2aa4925a

                      SHA1

                      a7ded3d99bb410016de179daef67bda99f4ac29f

                      SHA256

                      92b638f25bf8fcd796c1b5be1edb8f8eeb394189ac950a6cc8538e4c3d9152b7

                      SHA512

                      145e5e35b8870106aada551d3772e8bf041984e4d263fd12af9bf51e861857f1500575516efba9dfc2e769b708bfc5c7de25e7cc7827181b09c4dcec0d4c4a40

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

                      Filesize

                      170B

                      MD5

                      76d9c1b2f9080fa847aa077883d157b2

                      SHA1

                      96f83433ce78da1ec4940504c30f928775055677

                      SHA256

                      8b27bb1ae2560735068e11fe24b3f3cec9a7e0727a435e792f2a4298fa6baf00

                      SHA512

                      28585a2298139c5d3b47ca86616f5e6cf4a7dc5722df8c9652a0b47136c119abf8dc40afb436f98139c7b77c92d5e2550fc8402f69ec60c1262f3544644db9f1

                    • C:\Users\Admin\AppData\Local\Temp\Cab97BD.tmp

                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\api-ms-win-core-file-l1-2-0.dll

                      Filesize

                      21KB

                      MD5

                      1c58526d681efe507deb8f1935c75487

                      SHA1

                      0e6d328faf3563f2aae029bc5f2272fb7a742672

                      SHA256

                      ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

                      SHA512

                      8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\api-ms-win-core-file-l2-1-0.dll

                      Filesize

                      18KB

                      MD5

                      bfffa7117fd9b1622c66d949bac3f1d7

                      SHA1

                      402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

                      SHA256

                      1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

                      SHA512

                      b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\api-ms-win-core-localization-l1-2-0.dll

                      Filesize

                      21KB

                      MD5

                      724223109e49cb01d61d63a8be926b8f

                      SHA1

                      072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

                      SHA256

                      4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

                      SHA512

                      19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\api-ms-win-core-processthreads-l1-1-1.dll

                      Filesize

                      21KB

                      MD5

                      517eb9e2cb671ae49f99173d7f7ce43f

                      SHA1

                      4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

                      SHA256

                      57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

                      SHA512

                      492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\python313.dll

                      Filesize

                      1.8MB

                      MD5

                      1490ed147cdd2c2fb09259d2b6c42161

                      SHA1

                      11c639b79b11d6c6d2a5910e602b199e8c63fffe

                      SHA256

                      c47c6432c0c202e885b344a18dcb4e392999c9a78eb987720b48e0fcff2e6a61

                      SHA512

                      1f086ab3e2029ad450a9be92d3e367342b6eed52e7581647e7b88596a1cbee1d9b478c41ce956396e4056974f1f3fe148192828bad3613ab58ed2c3e758b8a03

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                      Filesize

                      4B

                      MD5

                      365c9bfeb7d89244f2ce01c1de44cb85

                      SHA1

                      d7a03141d5d6b1e88b6b59ef08b6681df212c599

                      SHA256

                      ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

                      SHA512

                      d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

                    • C:\Users\Admin\AppData\Local\Temp\_MEI10322\ucrtbase.dll

                      Filesize

                      992KB

                      MD5

                      0e0bac3d1dcc1833eae4e3e4cf83c4ef

                      SHA1

                      4189f4459c54e69c6d3155a82524bda7549a75a6

                      SHA256

                      8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

                      SHA512

                      a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

                    • C:\Users\Admin\Documents\System64Service.exe

                      Filesize

                      35KB

                      MD5

                      90957299e9047efc9634f190eff4f693

                      SHA1

                      0292c0f3389eae94e29a9d890a5518e142db5096

                      SHA256

                      a616be7d091cc959e4db7fc74fe52998ef675309af83e459282cda0828fa03b6

                      SHA512

                      109ba2d4ae56cad1226603cc9864d2e40c6fe7d4413cd9b8ffa185b0252ae69e81163bda4298fb198b1e58456eb4d7ee7487db7bde0ec76ea1273d821a094513

                    • C:\windows\system32\Windows_Systemservices64.exe

                      Filesize

                      3.1MB

                      MD5

                      52025b6114feff994df431c8a0a5c9ae

                      SHA1

                      4b0e9178616c83f68f45775eaacace6027dd42c2

                      SHA256

                      8c5c09639035ecd95ba08dd6aae713443b3f45614e1fde653b2d6f45156b4e7b

                      SHA512

                      03ee1109f2d0e79620f7f9fee61411762842cc77ccbc1bc25e98c97278e4ee7745d5e3d46d165761ba5134e228e45c270b1d05cdbda6fef51a3409b8e9cdb73f

                    • \Users\Admin\AppData\Local\Temp\_MEI10322\api-ms-win-core-timezone-l1-1-0.dll

                      Filesize

                      21KB

                      MD5

                      d12403ee11359259ba2b0706e5e5111c

                      SHA1

                      03cc7827a30fd1dee38665c0cc993b4b533ac138

                      SHA256

                      f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

                      SHA512

                      9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

                    • memory/1844-1633-0x0000000000220000-0x0000000000544000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/1976-1627-0x0000000001320000-0x0000000001644000-memory.dmp

                      Filesize

                      3.1MB

                    • memory/2436-844-0x000007FEF5BF0000-0x000007FEF6255000-memory.dmp

                      Filesize

                      6.4MB