Analysis
-
max time kernel
131s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 00:07
Behavioral task
behavioral1
Sample
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe
Resource
win7-20240611-en
General
-
Target
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe
-
Size
4.9MB
-
MD5
95b71f1e434be97a39998f49d32da40b
-
SHA1
ada21f3db506e3abb079b8cfb8c51a8924de2ed9
-
SHA256
1ae218c37667a4a96d4ce7e19b19a5a56fa17b112f3bf6e94e78671ad6077168
-
SHA512
c22511b254d29d22ea444cdf56ab9bb32a0e4d00c81b2d5e63a9394009ea7d4b747bc28a96cb845b62d998e91c3bcdf4f7e2dbaabc3f7dcdc92947b98c7e2559
-
SSDEEP
98304:2uhNyndYGvr22SsaNYfdPBldt6+dBcjHtKRJ6B6IbzZLRIbzZY:5cM7jGIRp+K
Malware Config
Extracted
quasar
1.4.1
Office04
mx5.deitie.asia:4495
ebbf737a-dddd-43dd-9b0a-74831302455d
-
encryption_key
F8516D89A1DFD78BD8FF575BBC3AE828B47FF0E1
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe family_quasar behavioral1/memory/1664-6-0x0000000000A00000-0x0000000000D24000-memory.dmp family_quasar behavioral1/memory/2640-57-0x00000000002B0000-0x00000000005D4000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/1664-6-0x0000000000A00000-0x0000000000D24000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2640-57-0x00000000002B0000-0x00000000005D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1664-6-0x0000000000A00000-0x0000000000D24000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2640-57-0x00000000002B0000-0x00000000005D4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/1664-6-0x0000000000A00000-0x0000000000D24000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2640-57-0x00000000002B0000-0x00000000005D4000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
UPX dump on OEP (original entry point) 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2552-7-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-25-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-47-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-45-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-49-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-43-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-41-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-39-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-38-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-35-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-31-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-29-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-27-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-23-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-22-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-19-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-50-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-17-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-15-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-13-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-11-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-9-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-33-0x0000000010000000-0x000000001003E000-memory.dmp UPX behavioral1/memory/2552-8-0x0000000010000000-0x000000001003E000-memory.dmp UPX -
Drops startup file 1 IoCs
Processes:
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe -
Executes dropped EXE 2 IoCs
Processes:
sign.exeClient.exepid process 1664 sign.exe 2640 Client.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exepid process 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe -
Processes:
resource yara_rule behavioral1/memory/2552-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-50-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2552-8-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2180 schtasks.exe 2204 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exepid process 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sign.exeClient.exedescription pid process Token: SeDebugPrivilege 1664 sign.exe Token: SeDebugPrivilege 2640 Client.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exepid process 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exesign.exeClient.exedescription pid process target process PID 2552 wrote to memory of 1664 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe sign.exe PID 2552 wrote to memory of 1664 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe sign.exe PID 2552 wrote to memory of 1664 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe sign.exe PID 2552 wrote to memory of 1664 2552 2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe sign.exe PID 1664 wrote to memory of 2180 1664 sign.exe schtasks.exe PID 1664 wrote to memory of 2180 1664 sign.exe schtasks.exe PID 1664 wrote to memory of 2180 1664 sign.exe schtasks.exe PID 1664 wrote to memory of 2640 1664 sign.exe Client.exe PID 1664 wrote to memory of 2640 1664 sign.exe Client.exe PID 1664 wrote to memory of 2640 1664 sign.exe Client.exe PID 2640 wrote to memory of 2204 2640 Client.exe schtasks.exe PID 2640 wrote to memory of 2204 2640 Client.exe schtasks.exe PID 2640 wrote to memory of 2204 2640 Client.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_95b71f1e434be97a39998f49d32da40b_icedid_poet-rat_quasar-rat_xrat.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\\sign.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sign.exeFilesize
3.1MB
MD57498d554976744dfbd271ba755c6c192
SHA1ec733d01e776518e387d2f51d1a6559b81f03b1e
SHA25644089202623b9671051aa5bba5e72f81f68ce818c3054dde57726aaa6dcb9ff7
SHA512d4e987d0e6235001fac4ae3a634e8fe98c6830e26a6a6876fbc36262842688d3ec301cff75003d2af695cdfd357ac50919946695b7d5d3293ebcba97153e1030
-
memory/1664-5-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmpFilesize
4KB
-
memory/1664-6-0x0000000000A00000-0x0000000000D24000-memory.dmpFilesize
3.1MB
-
memory/1664-58-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmpFilesize
9.9MB
-
memory/1664-51-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmpFilesize
9.9MB
-
memory/2552-29-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-19-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-39-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-38-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-35-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-31-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-47-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-27-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-23-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-22-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-50-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-25-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-17-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-15-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-13-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-11-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-9-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-33-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-8-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2552-7-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/2640-57-0x00000000002B0000-0x00000000005D4000-memory.dmpFilesize
3.1MB