Overview

overview

10

Static

static

3

14186818b4...8e.exe

windows10-2004-x64

10

14186818b4...8e.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    14186818b4277e51092c681811771097db5e950450e91bcf48dc254eed45b08e
  • Size 1.7MB
  • Sample260120-ghrmvsas9c
  • SHA256 14186818b4277e51092c681811771097db5e950450e91bcf48dc254eed45b08e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
cobaltstrikequasar12345678902026旺旺旺backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Extracted

Family

  • cobaltstrike

Botnet

  • 1234567890

C2

  • http://wc-ltc.ddns.net:16888/load

  • http://wc-ltc.ddns.me:16888/fwlink

  • http://wc-ltc.myvnc.com:16888/dot.gif

Attributes
  • access_type

    512

  • host

    wc-ltc.ddns.net,/load,wc-ltc.ddns.me,/fwlink,wc-ltc.myvnc.com,/dot.gif

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    16888

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC82i44F98bmNtSaaKPCZqe+J0g66oXzHNIuBocZVNE8G/YWXCf36w4LedfAzxmvtVEl83uOp0Rd01U9pBJ7IaD17RALsmjwkusrQf6XeGh8LcmaKD6Yfzxmpu31q+ODgXGFertk7izYpwyycGMFIqV5O8bfdFqXdh26FzlRE1SmwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)

  • watermark

    1234567890

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • 2026旺旺旺

C2

  • wc-ltc.ddns.net:2288

  • wc-ltc.myvnc.com:2288

  • wc-ltc.ddns.me:2288

Mutex

  • 458109aa-4008-442f-afaa-15388d7c7050

Attributes
  • encryption_key

    6369D995F947C3030645F8F85F31448DD4022B1F

  • install_name

    svchost.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows NT

  • subdirectory

    Fonts

Targets

    • Target
      14186818b4277e51092c681811771097db5e950450e91bcf48dc254eed45b08e
    • Size 1.7MB
    • SHA256 14186818b4277e51092c681811771097db5e950450e91bcf48dc254eed45b08e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    backdoor12345678902026旺旺旺defense_evasiondiscoveryexecutioncobaltstrikequasarpersistenceprivilege_escalationspywaretrojan

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • Cobaltstrike family

      cobaltstrike

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

2
T1059.001

Persistence

Account Manipulation

1
T1098

Event Triggered Execution

2
T1546

Accessibility Features

1
T1546.008

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Account Manipulation

1
T1098

Event Triggered Execution

2
T1546

Accessibility Features

1
T1546.008

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Credential Access

Discovery

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks