Analysis
-
max time kernel
40s -
max time network
36s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
04-01-2025 11:13
General
-
Target
ripplewoofer.exe
-
Size
3.1MB
-
MD5
aefac3053fe23e06c3cd4c123a69ca37
-
SHA1
3971e70e42e0148deb5b879da32bdcf6e3702197
-
SHA256
af6a17197ef3da87971496daf39475598053e250d58c82c610d55ce4267102e2
-
SHA512
2d611803fabd368214d61ef345eea20e41090a4db196e300782fb06d6fada2c548f909e3362a7c40852b3aab239b60e1acd613e523508be18f5e370375f40242
-
SSDEEP
49152:GvUt62XlaSFNWPjljiFa2RoUYItaRJ61bR3LoGdf4pTHHB72eh2NT:GvI62XlaSFNWPjljiFXRoUYItaRJ6HP
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.0.28:4782
21dc5e45-8c42-4e7e-a882-b318788e9ca8
-
encryption_key
C77A16FAC6C225B2DB880A8156F0D384EB290A9E
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Boostrapper
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 49 IoCs
-
Suspicious use of SendNotifyMessage 49 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ripplewoofer.exe"C:\Users\Admin\AppData\Local\Temp\ripplewoofer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Boostrapper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Boostrapper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5aefac3053fe23e06c3cd4c123a69ca37
SHA13971e70e42e0148deb5b879da32bdcf6e3702197
SHA256af6a17197ef3da87971496daf39475598053e250d58c82c610d55ce4267102e2
SHA5122d611803fabd368214d61ef345eea20e41090a4db196e300782fb06d6fada2c548f909e3362a7c40852b3aab239b60e1acd613e523508be18f5e370375f40242
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
712KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
3.1MB
-
Filesize
10.8MB