Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 00:46
Behavioral task
behavioral1
Sample
2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe
Resource
win7-20240220-en
General
-
Target
2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe
-
Size
4.8MB
-
MD5
1878733d5f2872169c33653a1ac9b623
-
SHA1
738a018c2c738e93ffa6dce3932ee994aa7b11e3
-
SHA256
f181b5a4e2f0dc0cdf70e16c18e3466e436aae0bb96ef9b7dc24c7f219167115
-
SHA512
bc0d3a8a84efcc80b7768efc0b4071722bdfdbb63c9ea9b5e45089257ee527772dfb9f2a259d10abf8ecc54c1816917d5a527bbd87adca333543cb0f1610a4b9
-
SSDEEP
98304:EQfNOLY2uXHEvr22SsaNYfdPBldt6+dBcjHtKRJ6BJIbzZ3IbzZY:eQHSM7jGImWK
Malware Config
Extracted
quasar
1.4.1
Office04
mx5.deitie.asia:4495
ebbf737a-dddd-43dd-9b0a-74831302455d
-
encryption_key
F8516D89A1DFD78BD8FF575BBC3AE828B47FF0E1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe family_quasar behavioral2/memory/2824-5-0x00000000009B0000-0x0000000000CD4000-memory.dmp family_quasar -
Drops startup file 1 IoCs
Processes:
2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe -
Executes dropped EXE 2 IoCs
Processes:
sign.exeClient.exepid process 2824 sign.exe 700 Client.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1584 schtasks.exe 4720 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exepid process 1804 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe 1804 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sign.exeClient.exedescription pid process Token: SeDebugPrivilege 2824 sign.exe Token: SeDebugPrivilege 700 Client.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exepid process 1804 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe 1804 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exesign.exeClient.exedescription pid process target process PID 1804 wrote to memory of 2824 1804 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe sign.exe PID 1804 wrote to memory of 2824 1804 2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe sign.exe PID 2824 wrote to memory of 1584 2824 sign.exe schtasks.exe PID 2824 wrote to memory of 1584 2824 sign.exe schtasks.exe PID 2824 wrote to memory of 700 2824 sign.exe Client.exe PID 2824 wrote to memory of 700 2824 sign.exe Client.exe PID 700 wrote to memory of 4720 700 Client.exe schtasks.exe PID 700 wrote to memory of 4720 700 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-26_1878733d5f2872169c33653a1ac9b623_icedid_poet-rat_quasar-rat_xrat.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\sign.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exeFilesize
3.1MB
MD57498d554976744dfbd271ba755c6c192
SHA1ec733d01e776518e387d2f51d1a6559b81f03b1e
SHA25644089202623b9671051aa5bba5e72f81f68ce818c3054dde57726aaa6dcb9ff7
SHA512d4e987d0e6235001fac4ae3a634e8fe98c6830e26a6a6876fbc36262842688d3ec301cff75003d2af695cdfd357ac50919946695b7d5d3293ebcba97153e1030
-
memory/700-14-0x000000001BA40000-0x000000001BA90000-memory.dmpFilesize
320KB
-
memory/700-15-0x000000001BB50000-0x000000001BC02000-memory.dmpFilesize
712KB
-
memory/2824-4-0x00007FFA61A73000-0x00007FFA61A75000-memory.dmpFilesize
8KB
-
memory/2824-5-0x00000000009B0000-0x0000000000CD4000-memory.dmpFilesize
3.1MB
-
memory/2824-6-0x00007FFA61A70000-0x00007FFA62531000-memory.dmpFilesize
10.8MB
-
memory/2824-13-0x00007FFA61A70000-0x00007FFA62531000-memory.dmpFilesize
10.8MB