Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250128-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    29-01-2025 14:10

General

  • Target

    random.exe

  • Size

    2.6MB

  • MD5

    6416961fe33e1461e8f5c455c2cf0ec9

  • SHA1

    190754691dffb4d873bd32f48722d150d338f51d

  • SHA256

    616bbced150df4c538374a032a176e88165f5e95f3fffaeae28ffa68cda552a1

  • SHA512

    8fe2fa84a62cf92d1136110e0b39bfb7f07646816ff9d9944a0d8523d26d2f2d46653ec2a9f1153fac6b3c585e0f742753959d496cab1f5a62c761dd0db1fc18

  • SSDEEP

    49152:Ux8Gt7KDrJd8spKaFxZWVAItl6dXg84Hk6BOUjbqmQnN/DAP8khk2d4zV:C974P57k6dQ8bIO2uN/DAP8khkj

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

1

C2

87.228.57.81:4782

Mutex

f832b3aa-9229-4dd0-81ec-c101146b1831

Attributes
  • encryption_key

    19A0FAF8459F69650B5965C225752D425C429EEC

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to execute payload.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\random.exe
    "C:\Users\Admin\AppData\Local\Temp\random.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\is-HLTAH.tmp\random.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HLTAH.tmp\random.tmp" /SL5="$7014C,2299112,208384,C:\Users\Admin\AppData\Local\Temp\random.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4224
      • C:\Users\Admin\AppData\Local\Temp\random.exe
        "C:\Users\Admin\AppData\Local\Temp\random.exe" /VERYSILENT
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4548
        • C:\Users\Admin\AppData\Local\Temp\is-LQ6E0.tmp\random.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-LQ6E0.tmp\random.tmp" /SL5="$501CA,2299112,208384,C:\Users\Admin\AppData\Local\Temp\random.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Windows\SysWOW64\regsvr32.exe
            "regsvr32.exe" /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\8dnsapi_5.drv"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4636
            • C:\Windows\system32\regsvr32.exe
              /s /i:SYNC "C:\Users\Admin\AppData\Roaming\\8dnsapi_5.drv"
              6⤵
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2872
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv' }) { exit 0 } else { exit 1 }"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4932
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:SYNC C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{ACF8C0CD-AB3A-4F59-B223-8CA4269FFE44}' -Description 'MicrosoftEdgeUpdateTaskMachineUA' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2444
  • C:\Windows\system32\regsvr32.EXE
    "C:\Windows\system32\regsvr32.EXE" /S /i:SYNC C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3836
  • C:\Windows\system32\regsvr32.EXE
    "C:\Windows\system32\regsvr32.EXE" /S /i:SYNC C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:SYNC C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    3eb3833f769dd890afc295b977eab4b4

    SHA1

    e857649b037939602c72ad003e5d3698695f436f

    SHA256

    c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

    SHA512

    c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    178170c54a9081cc3aaac9ee2318211e

    SHA1

    94b0fd6cb5834be48fa39a95997a8852a6b64cc4

    SHA256

    906632fc1b247d32a6a2130ccf9062231984e8f2e7beddd511bbd19901fdb054

    SHA512

    71231d4c7d670dd444fc9a392b33ed1008fb815a03760357f43c43c77adf1d83b05a94dee240a50d1ba3f1cad5055c181aa3351f8719fb6d3939b785a224db15

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    d8d7aa0fa134f748201458c017b5682f

    SHA1

    eab823b449a0926042f47f97039aad611aff3bc3

    SHA256

    7f5640202e6963b46d96139c361ebb7b6949951b9bac1c771d329cad75199324

    SHA512

    2f0b9e67c8362b536b25fd47e74a17c0693b0c0b9509cf1e70011da0d16fa70b080111fc0992884ec6e6da4a4fb7304a3b49acf88d334672c960235620078d43

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    a9d5a55646a268805a98533fe53dd0c0

    SHA1

    8e870960de2f16d5688b6d7d8d9f88507220bd8f

    SHA256

    04f95e259d0a862c42bbf0b81e79cf760a8e223781cb4259f8ca8127d41fe488

    SHA512

    94a9ac797018a1ca784edffa7452a66b48d46f853904e3789ac0693b6d350a0ab64c3b72e7aa0e33ab884b54c0c87ad3444b41e6fa484eb3159b97fb4424a5e8

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l314ioa5.hjv.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\is-BUD4M.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • C:\Users\Admin\AppData\Local\Temp\is-C9LKD.tmp\_isetup\_isdecmp.dll

    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • C:\Users\Admin\AppData\Local\Temp\is-HLTAH.tmp\random.tmp

    Filesize

    1.2MB

    MD5

    1db83d1bc949e72509f0e752316ec5d0

    SHA1

    154d7bd59581ea106d8a02586feaf5c38f806d39

    SHA256

    57c68e06bd351b2fde4f25f04c89fc265c0c3ce3184fb0caca3410b6eac04a49

    SHA512

    ff0eba3e3a9407107d2e5875d4369be68c1f1f43144aea8c9b530824f3b9c837705ecd0c7d94bbaadfa59bb273b7e59392bef3d9aaf643353e4b935f8745d4b2

  • C:\Users\Admin\AppData\Roaming\8dnsapi_5.drv

    Filesize

    4.1MB

    MD5

    6fb91b9f96c8a0f6e20e75377152363a

    SHA1

    be3ed35dee6b517b9e846bc431197c2d6239f8e1

    SHA256

    be67966b82dcb5e838095d0ebcccbc854b6eae9d6ac30329457019f2d7d119ae

    SHA512

    da994e4ee32aee52d98d21ab69887d94efe186d9e0a34b2cc09e0da949fb25a10de464136c305a66c332457d876e5e6ce2acaf6c4f1ba00f7e6345cdda030996

  • memory/1144-104-0x00007FFD5BBF0000-0x00007FFD5BFF1000-memory.dmp

    Filesize

    4.0MB

  • memory/2248-2-0x0000000000401000-0x0000000000417000-memory.dmp

    Filesize

    88KB

  • memory/2248-30-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2248-0-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2872-86-0x00007FFD5BBF0000-0x00007FFD5BFF1000-memory.dmp

    Filesize

    4.0MB

  • memory/2872-85-0x000000001D180000-0x000000001D232000-memory.dmp

    Filesize

    712KB

  • memory/2872-83-0x000000001C2D0000-0x000000001C5F4000-memory.dmp

    Filesize

    3.1MB

  • memory/2872-84-0x000000001D070000-0x000000001D0C0000-memory.dmp

    Filesize

    320KB

  • memory/4080-123-0x00007FFD5BBF0000-0x00007FFD5BFF1000-memory.dmp

    Filesize

    4.0MB

  • memory/4224-26-0x0000000000400000-0x0000000000538000-memory.dmp

    Filesize

    1.2MB

  • memory/4224-7-0x0000000000400000-0x0000000000538000-memory.dmp

    Filesize

    1.2MB

  • memory/4264-52-0x0000000000400000-0x0000000000538000-memory.dmp

    Filesize

    1.2MB

  • memory/4264-31-0x0000000000400000-0x0000000000538000-memory.dmp

    Filesize

    1.2MB

  • memory/4548-55-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4548-23-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4548-21-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/4932-62-0x000002C3A3020000-0x000002C3A3042000-memory.dmp

    Filesize

    136KB