Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2025, 13:57

General

  • Target

    0c8c53fc87610174bd8d304940ed84dd.exe

  • Size

    2.6MB

  • MD5

    0c8c53fc87610174bd8d304940ed84dd

  • SHA1

    e049d2b70beec23414f252d3aab26f179e1573bc

  • SHA256

    eee98aabaf632f6d85b08f40401058696980c57a60bbf57ffae069e6ee1b827c

  • SHA512

    7150b0f65b6bb01d8be8d36a49c08239950384aa4382bda387b8de733f3f4f0db9eabf148e85b9b11efaf60761be703a6c28fdfdc6df87b03db6fb96acc4380e

  • SSDEEP

    49152:b+PPOOZeF0a/ICoVrIdEXZe1pVhZ88hfOKx/13ZvTIqab7SNudXjdTF:HOk0axoVrIuXytKtKTrROJF

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

bild

C2

147.45.44.184:4782

Mutex

c3e182b5-304a-49a7-85b2-6d514cf6f590

Attributes
  • encryption_key

    7248469493201CDB45E041FBAB664BCC303EC021

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe
    "C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\is-K7DIK.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-K7DIK.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$6021C,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe
        "C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Users\Admin\AppData\Local\Temp\is-M31L1.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-M31L1.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp" /SL5="$601C6,2280623,161792,C:\Users\Admin\AppData\Local\Temp\0c8c53fc87610174bd8d304940ed84dd.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:232
          • C:\Windows\SysWOW64\regsvr32.exe
            "regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4692
            • C:\Windows\system32\regsvr32.exe
              /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\1iphlpapi.drv"
              6⤵
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4340
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5076
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{5C0D093C-5170-466B-EA9E-971247BAEBD3}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1832
  • C:\Windows\system32\regsvr32.EXE
    C:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3468
  • C:\Windows\system32\regsvr32.EXE
    C:\Windows\system32\regsvr32.EXE /S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\1iphlpapi.drv' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    661739d384d9dfd807a089721202900b

    SHA1

    5b2c5d6a7122b4ce849dc98e79a7713038feac55

    SHA256

    70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

    SHA512

    81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    2ac3c9ba89b8c2ef19c601ecebb82157

    SHA1

    a239a4b11438c00e5ff89ebd4a804ede6a01935b

    SHA256

    3c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e

    SHA512

    b1221d29e747b37071761b2509e9109b522cce6411f73f27c9428ac332d26b9f413ae6b8c0aeac1afb7fab2d0b3b1c4af189da12fe506287596df2ef8f083432

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    a37d50419f9463557ba395bd8249f5b6

    SHA1

    1e94df7e8e5250fe70562bf4d5538c63b3171851

    SHA256

    7e12a5fac8da60dc67fd5d691fe4ee244d974c07d579488863558c9ebe14c1fa

    SHA512

    cdd4fa55ab83ed2c68d8df444755a374899bb6b6f8fd829a014b3fc2f4e17536e357a288bc8209432aa2992a35f7d1df0e04c9bc82af46e04c89b69302f1a238

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    12c844ed8342738dacc6eb0072c43257

    SHA1

    b7f2f9e3ec4aaf5e2996720f129cd64887ac91d7

    SHA256

    2afeb7db4e46d3c1524512a73448e9cd0121deec761d8aa54fa9fe8b56df7519

    SHA512

    e3de9103533a69cccc36cd377297ba3ec9bd7a1159e1349d2cc01ab66a88a5a82b4ee3af61fab586a0cdfab915c7408735439fd0462c5c2cc2c787cb0765766a

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uoqcce24.jhr.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\is-2OSHP.tmp\_isetup\_isdecmp.dll

    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • C:\Users\Admin\AppData\Local\Temp\is-FPDRU.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • C:\Users\Admin\AppData\Local\Temp\is-K7DIK.tmp\0c8c53fc87610174bd8d304940ed84dd.tmp

    Filesize

    1.1MB

    MD5

    bcc236a3921e1388596a42b05686ff5e

    SHA1

    43bffbbac6a1bf5f1fa21e971e06e6f1d0af9263

    SHA256

    43a656bcd060e8a36502ca2deb878d56a99078f13d3e57dcd73a87128588c9e9

    SHA512

    e3baaf1a8f4eb0e1ab57a1fb35bc7ded476606b65fafb09835d34705d8c661819c3cfa0ecc43c5a0d0085fd570df581438de27944e054e12c09a6933bbf5ce04

  • C:\Users\Admin\AppData\Roaming\1iphlpapi.drv

    Filesize

    4.2MB

    MD5

    0eb9dd8cd99ba5cda1580cedd1337c47

    SHA1

    47d50257261756ee304375fa84531cde9f1b2d80

    SHA256

    744ef584ca4ac58a3ee825f5ead1129753d6d44198b3b14a53e368b7d24e84ef

    SHA512

    2e7c3cc9cdbca9776b1e4ffa004a761d40629e4e5c5626df73367e1f41f7c560d3ae496a0ea211db497d7437855e9686205fb32220e23fab30f8b489d232e25a

  • memory/232-31-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/232-52-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/1520-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1520-27-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/1520-2-0x0000000000401000-0x0000000000417000-memory.dmp

    Filesize

    88KB

  • memory/1756-25-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/1756-7-0x0000000000400000-0x000000000052D000-memory.dmp

    Filesize

    1.2MB

  • memory/4328-107-0x00007FFEEDA60000-0x00007FFEEDE7C000-memory.dmp

    Filesize

    4.1MB

  • memory/4340-87-0x000000001C1D0000-0x000000001C1E2000-memory.dmp

    Filesize

    72KB

  • memory/4340-82-0x000000001C210000-0x000000001C534000-memory.dmp

    Filesize

    3.1MB

  • memory/4340-83-0x000000001C160000-0x000000001C1B0000-memory.dmp

    Filesize

    320KB

  • memory/4340-84-0x000000001D070000-0x000000001D122000-memory.dmp

    Filesize

    712KB

  • memory/4340-88-0x000000001D7F0000-0x000000001D82C000-memory.dmp

    Filesize

    240KB

  • memory/4340-89-0x00007FFEEDA60000-0x00007FFEEDE7C000-memory.dmp

    Filesize

    4.1MB

  • memory/4468-126-0x00007FFEEDA60000-0x00007FFEEDE7C000-memory.dmp

    Filesize

    4.1MB

  • memory/4956-21-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/4956-23-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/4956-54-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/5076-61-0x000001FDF6F00000-0x000001FDF6F22000-memory.dmp

    Filesize

    136KB