latentbot | c973b6a179d4477cc0d52ca84e6083a679988d991b53cb29573c75668b154f2e

General

Target

PatricksParabox.exe
Size

3.2MB
MD5

0a717705a7797e35b6f5af62ffe43abb
SHA1

4c823754c6cebe13ae0aec7ba874318f20445145
SHA256

c973b6a179d4477cc0d52ca84e6083a679988d991b53cb29573c75668b154f2e
SHA512

75d39a3fbbf3b6289330aab45471d497dec51d076dc96bf29b0bc526154bb9502745f08aee14624bca8c7b0f2c5822e2f81a8b959cd8348457015b06a2fe9ead
SSDEEP

98304:zvr62XlaSFNWPjljiFXRoUYITrUCgLEEa1:75ZY2gLEEa1

Score

10^/10

latentbot quasar hugrix spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Hugrix

C2

prxprodquasar.zapto.org:4782

Mutex

ad6032ec-a1ba-49fe-a6c9-21a847436cda

Attributes

encryption_key
7AB142AC063BEB01BE33EE315E2D0BBA3E071A0B
install_name
JavaUpdater.exe
log_directory
JavaInstallLogs
reconnect_delay
3000
startup_key
Java Updater
subdirectory
Java

Extracted

Family

latentbot

C2

prxprodquasar.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3200-1-0x0000000000FB0000-0x00000000012EE000-memory.dmp	family_quasar
behavioral2/files/0x001f000000023b28-6.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3276	JavaUpdater.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\Java\JavaUpdater.exe	PatricksParabox.exe
File opened for modification	C:\Windows\system32\Java\JavaUpdater.exe	PatricksParabox.exe
File opened for modification	C:\Windows\system32\Java	PatricksParabox.exe
File opened for modification	C:\Windows\system32\Java\JavaUpdater.exe	JavaUpdater.exe
File opened for modification	C:\Windows\system32\Java	JavaUpdater.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4104	schtasks.exe
4920	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	PatricksParabox.exe
Token: SeDebugPrivilege	3276	JavaUpdater.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3276	JavaUpdater.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4104	3200	PatricksParabox.exe	87
PID 3200 wrote to memory of 4104	3200	PatricksParabox.exe	87
PID 3200 wrote to memory of 3276	3200	PatricksParabox.exe	89
PID 3200 wrote to memory of 3276	3200	PatricksParabox.exe	89
PID 3276 wrote to memory of 4920	3276	JavaUpdater.exe	90
PID 3276 wrote to memory of 4920	3276	JavaUpdater.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PatricksParabox.exe
"C:\Users\Admin\AppData\Local\Temp\PatricksParabox.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Windows\system32\Java\JavaUpdater.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4104
- C:\Windows\system32\Java\JavaUpdater.exe
  "C:\Windows\system32\Java\JavaUpdater.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Windows\system32\Java\JavaUpdater.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\Java\JavaUpdater.exe

Filesize
3.2MB

MD5
0a717705a7797e35b6f5af62ffe43abb

SHA1
4c823754c6cebe13ae0aec7ba874318f20445145

SHA256
c973b6a179d4477cc0d52ca84e6083a679988d991b53cb29573c75668b154f2e

SHA512
75d39a3fbbf3b6289330aab45471d497dec51d076dc96bf29b0bc526154bb9502745f08aee14624bca8c7b0f2c5822e2f81a8b959cd8348457015b06a2fe9ead

Download Submit
memory/3200-0-0x00007FFE47F73000-0x00007FFE47F75000-memory.dmp

Filesize
8KB

Download
memory/3200-1-0x0000000000FB0000-0x00000000012EE000-memory.dmp

Filesize
3.2MB

Download
memory/3200-2-0x00007FFE47F70000-0x00007FFE48A31000-memory.dmp

Filesize
10.8MB

Download
memory/3200-10-0x00007FFE47F70000-0x00007FFE48A31000-memory.dmp

Filesize
10.8MB

Download
memory/3276-9-0x00007FFE47F70000-0x00007FFE48A31000-memory.dmp

Filesize
10.8MB

Download
memory/3276-11-0x00007FFE47F70000-0x00007FFE48A31000-memory.dmp

Filesize
10.8MB

Download
memory/3276-12-0x0000000002B70000-0x0000000002BC0000-memory.dmp

Filesize
320KB

Download
memory/3276-13-0x000000001BE30000-0x000000001BEE2000-memory.dmp

Filesize
712KB

Download
memory/3276-14-0x0000000002BE0000-0x0000000002BF2000-memory.dmp

Filesize
72KB

Download
memory/3276-15-0x000000001B620000-0x000000001B65C000-memory.dmp

Filesize
240KB

Download
memory/3276-16-0x00007FFE47F70000-0x00007FFE48A31000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads