Edit tour

Windows Analysis Report
Client-built.exe

Overview

General Information

Sample name:	Client-built.exe
Analysis ID:	1579699
MD5:	beb1de229b374cd778107c8268e191ac
SHA1:	fb5dcf278195472e206fa484f7005aa485c308ae
SHA256:	604b99f997d7de70804667e6e985627485d1a4d1eb694f3c36a34f0a01aef7bd
Tags:	exeQuasarRATuser-lontze7
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected Quasar RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Client-built.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\Client-built.exe" MD5: BEB1DE229B374CD778107C8268E191AC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Host:Port": "R,,JA3V=g)s~", "InstallName": "Xs_V", "MutexName": "j\"Cy", "StartupKey": "4;rQac\"", "Tag": "?JHvg)*i_)1", "ServerSignature": "q{gyhL'y", "ServerCertificate": ">vK&Mh1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Client-built.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Client-built.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Client-built.exe	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ec0e:$a1: GetKeyloggerLogsResponse 0x3e36f:$a2: DoDownloadAndExecute 0x50820:$a3: http://api.ipify.org/ 0x4e329:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f677:$a5: " /sc ONLOGON /tr "
Client-built.exe	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3e12b:$s1: DoUploadAndExecute 0x3e36f:$s2: DoDownloadAndExecute 0x3def0:$s3: DoShellExecute 0x3e327:$s4: set_Processname 0x5a24:$op1: 04 1E FE 02 04 16 FE 01 60 0x5948:$op2: 00 17 03 1F 20 17 19 15 28 0x63ae:$op3: 00 04 03 69 91 1B 40 0x6bfe:$op3: 00 04 03 69 91 1B 40
Client-built.exe	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3ec0e:$x1: GetKeyloggerLogsResponse 0x3ee4e:$s1: DoShellExecuteResponse 0x3e7bd:$s2: GetPasswordsResponse 0x3ed21:$s3: GetStartupItemsResponse 0x3e13f:$s5: RunHidden 0x3e15d:$s5: RunHidden 0x3e16b:$s5: RunHidden 0x3e17f:$s5: RunHidden
Client-built.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4f63d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x4f873:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
Client-built.exe	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3ec0e:$x3: GetKeyloggerLogsResponse 0x3de66:$x4: GetKeyloggerLogs 0x3e13e:$s1: <RunHidden>k__BackingField 0x3edd6:$s2: set_SystemInfos 0x3e167:$s3: set_RunHidden 0x3dc9a:$s4: set_RemotePath 0x56628:$s6: Client.exe 0x566bc:$s6: Client.exe 0x3202a:$s7: xClient.Core.ReverseProxy.Packets
Client-built.exe	xRAT_1	Detects Patchwork malware	Florian Roth	0x305c0:$x4: xClient.Properties.Resources.resources 0x30481:$s4: Client.exe 0x3e167:$s7: set_RunHidden
Client-built.exe	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x51627:$x2: Process already elevated. 0x3a2e3:$x4: get_encryptedPassword 0x3e36f:$x5: DoDownloadAndExecute
Client-built.exe	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4f036:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ec4a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33fc6:$class: Core.MouseKeyHook.WinApi
Client-built.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x4eefa:$f1: FileZilla\recentservers.xml 0x4ef3a:$f2: FileZilla\sitemanager.xml 0x4ef6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x4e4e5:$b1: Chrome\User Data\ 0x4e549:$b1: Chrome\User Data\ 0x4e8dc:$b2: Mozilla\Firefox\Profiles 0x4ecb0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x53520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x4ed40:$b4: Opera Software\Opera Stable\Login Data 0x4edf0:$b5: YandexBrowser\User Data\ 0x4ee62:$b5: YandexBrowser\User Data\ 0x4e690:$s4: logins.json 0x4e6dc:$s4: logins.json 0x4e9ca:$s4: logins.json 0x4e1fa:$a1: username_value 0x4e218:$a2: password_value 0x3a2bb:$a3: encryptedUsername 0x3a2d1:$a3: encryptedUsername 0x3a407:$a3: encryptedUsername 0x3a2e7:$a4: encryptedPassword 0x3a2fd:$a4: encryptedPassword
Client-built.exe	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3ec0e:$s1: GetKeyloggerLogsResponse 0x3de66:$s2: GetKeyloggerLogs 0x4daca:$s3: />Log created on 0x4ec4a:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x4e329:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x51cfa:$s6: grabber_ 0x51d16:$s6: grabber_ 0x33027:$s7: <virtualKeyCode> 0x3e13e:$s8: <RunHidden>k__BackingField 0x33059:$s9: <keyboardHookStruct> 0x36406:$s10: add_OnHotKeysDown 0x36458:$s10: add_OnHotKeysDown 0x50688:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x50d45:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2643899248.0000000002B91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ea0e:$a1: GetKeyloggerLogsResponse 0x3e16f:$a2: DoDownloadAndExecute 0x50620:$a3: http://api.ipify.org/ 0x4e129:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f477:$a5: " /sc ONLOGON /tr "
00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3df2b:$s1: DoUploadAndExecute 0x3e16f:$s2: DoDownloadAndExecute 0x3dcf0:$s3: DoShellExecute 0x3e127:$s4: set_Processname 0x5824:$op1: 04 1E FE 02 04 16 FE 01 60 0x5748:$op2: 00 17 03 1F 20 17 19 15 28 0x61ae:$op3: 00 04 03 69 91 1B 40 0x69fe:$op3: 00 04 03 69 91 1B 40
00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4ee36:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ea4a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33dc6:$class: Core.MouseKeyHook.WinApi
Process Memory Space: Client-built.exe PID: 7528	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Client-built.exe.790000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.Client-built.exe.790000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.Client-built.exe.790000.0.unpack	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ec0e:$a1: GetKeyloggerLogsResponse 0x3e36f:$a2: DoDownloadAndExecute 0x50820:$a3: http://api.ipify.org/ 0x4e329:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f677:$a5: " /sc ONLOGON /tr "
0.0.Client-built.exe.790000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3e12b:$s1: DoUploadAndExecute 0x3e36f:$s2: DoDownloadAndExecute 0x3def0:$s3: DoShellExecute 0x3e327:$s4: set_Processname 0x5a24:$op1: 04 1E FE 02 04 16 FE 01 60 0x5948:$op2: 00 17 03 1F 20 17 19 15 28 0x63ae:$op3: 00 04 03 69 91 1B 40 0x6bfe:$op3: 00 04 03 69 91 1B 40
0.0.Client-built.exe.790000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3ec0e:$x1: GetKeyloggerLogsResponse 0x3ee4e:$s1: DoShellExecuteResponse 0x3e7bd:$s2: GetPasswordsResponse 0x3ed21:$s3: GetStartupItemsResponse 0x3e13f:$s5: RunHidden 0x3e15d:$s5: RunHidden 0x3e16b:$s5: RunHidden 0x3e17f:$s5: RunHidden
0.0.Client-built.exe.790000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4f63d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x4f873:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.Client-built.exe.790000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3ec0e:$x3: GetKeyloggerLogsResponse 0x3de66:$x4: GetKeyloggerLogs 0x3e13e:$s1: <RunHidden>k__BackingField 0x3edd6:$s2: set_SystemInfos 0x3e167:$s3: set_RunHidden 0x3dc9a:$s4: set_RemotePath 0x56628:$s6: Client.exe 0x566bc:$s6: Client.exe 0x3202a:$s7: xClient.Core.ReverseProxy.Packets
0.0.Client-built.exe.790000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x305c0:$x4: xClient.Properties.Resources.resources 0x30481:$s4: Client.exe 0x3e167:$s7: set_RunHidden
0.0.Client-built.exe.790000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x51627:$x2: Process already elevated. 0x3a2e3:$x4: get_encryptedPassword 0x3e36f:$x5: DoDownloadAndExecute
0.0.Client-built.exe.790000.0.unpack	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4f036:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ec4a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33fc6:$class: Core.MouseKeyHook.WinApi
0.0.Client-built.exe.790000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x4eefa:$f1: FileZilla\recentservers.xml 0x4ef3a:$f2: FileZilla\sitemanager.xml 0x4ef6e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x4e4e5:$b1: Chrome\User Data\ 0x4e549:$b1: Chrome\User Data\ 0x4e8dc:$b2: Mozilla\Firefox\Profiles 0x4ecb0:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x53520:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x4ed40:$b4: Opera Software\Opera Stable\Login Data 0x4edf0:$b5: YandexBrowser\User Data\ 0x4ee62:$b5: YandexBrowser\User Data\ 0x4e690:$s4: logins.json 0x4e6dc:$s4: logins.json 0x4e9ca:$s4: logins.json 0x4e1fa:$a1: username_value 0x4e218:$a2: password_value 0x3a2bb:$a3: encryptedUsername 0x3a2d1:$a3: encryptedUsername 0x3a407:$a3: encryptedUsername 0x3a2e7:$a4: encryptedPassword 0x3a2fd:$a4: encryptedPassword
0.0.Client-built.exe.790000.0.unpack	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3ec0e:$s1: GetKeyloggerLogsResponse 0x3de66:$s2: GetKeyloggerLogs 0x4daca:$s3: />Log created on 0x4ec4a:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x4e329:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x51cfa:$s6: grabber_ 0x51d16:$s6: grabber_ 0x33027:$s7: <virtualKeyCode> 0x3e13e:$s8: <RunHidden>k__BackingField 0x33059:$s9: <keyboardHookStruct> 0x36406:$s10: add_OnHotKeysDown 0x36458:$s10: add_OnHotKeysDown 0x50688:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x50d45:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 7 entries

Suricata Signatures

ET MALWARE Common RAT Connectivity Check Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T07:49:32.320518+0100	2036383	1	A Network Trojan was detected	192.168.2.8	49706	208.95.112.1	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Client-built.exe

Avira: detected

Found malware configuration

Source: Client-built.exe

Malware Configuration Extractor: Quasar {"Host:Port": "R,,JA3V=g)s~", "InstallName": "Xs_V", "MutexName": "j\"Cy", "StartupKey": "4;rQac\"", "Tag": "?JHvg)*i_)1", "ServerSignature": "q{gyhL'y", "ServerCertificate": ">vK&Mh1"}

Multi AV Scanner detection for submitted file

Source: Client-built.exe	ReversingLabs: Detection: 84%
Source: Client-built.exe	Virustotal: Detection: 85%			Perma Link

Yara detected Quasar RAT

Source: Yara match	File source: Client-built.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2643899248.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7528, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Client-built.exe

Joe Sandbox ML: detected

Source: Client-built.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Client-built.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2036383 - Severity 1 - ET MALWARE Common RAT Connectivity Check Observed : 192.168.2.8:49706 -> 208.95.112.1:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: R,,JA3V=g)s~

Yara detected Generic Downloader

Source: Yara match	File source: Client-built.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 20.107.53.25:25535

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	TCP traffic detected without corresponding DNS query: 20.107.53.25
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: Client-built.exe	String found in binary or memory: http://api.ipify.org/
Source: Client-built.exe	String found in binary or memory: http://freegeoip.net/xml/
Source: Client-built.exe, 00000000.00000002.2643899248.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000000.00000002.2643899248.0000000002BF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Client-built.exe	String found in binary or memory: http://ip-api.com/json/
Source: Client-built.exe, 00000000.00000002.2643899248.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Client-built.exe, 00000000.00000002.2643899248.0000000002BF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: Client-built.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2643899248.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7528, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: Client-built.exe, type: SAMPLE	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: Client-built.exe, type: SAMPLE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: Client-built.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: Client-built.exe, type: SAMPLE	Matched rule: QuasarRAT payload Author: ditekSHen
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: QuasarRAT payload Author: ditekSHen
Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_0100A550	0_2_0100A550
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_01009C80	0_2_01009C80
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_01009938	0_2_01009938
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_063F7558	0_2_063F7558
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_063F0BD8	0_2_063F0BD8

Source: Client-built.exe, 00000000.00000002.2642803865.0000000000B78000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Client-built.exe
Source: Client-built.exe, 00000000.00000000.1385931302.00000000007EA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs Client-built.exe
Source: Client-built.exe	Binary or memory string: OriginalFilenameClient.exe" vs Client-built.exe

Source: Client-built.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Client-built.exe, type: SAMPLE	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: Client-built.exe, type: SAMPLE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Client-built.exe, type: SAMPLE	Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: Client-built.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: Client-built.exe, type: SAMPLE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Client-built.exe, type: SAMPLE	Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Client-built.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Client-built.exe, type: SAMPLE	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: Client-built.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: Client-built.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan

Source: Client-built.exe, -----.cs

Base64 encoded string: 'U9mEqFFePKyJgWfGKrysKk/+Tn++pG5Z8oKyNNY5MLX3+2sDLbRdJdtKhKxVlLQ9olPPgnXL4B9t2SOVzsDcAw==', 'QII64E3A8rYLnZZFKbBwCwgdF335azLTXaW5ZPbiNye6AgEVgWf0kA7NGaaMbBLCqeA7YPXDQ7Qsw/uWTzPVZ6QFbq3l90vLCvBJ2EvL7D8=', 'NcFtjbDOcsw7Evd3coMC0y4koy/SRZGydhNmno81ZOWOvdfg7sv0Cj5ad2ROUfX4QMscAIjYJdjrrs41+qcQwg==', 'lPLDE7zFeXRhLfAkD1rXRdS6D0xPUsNEI9OfeLkvdsgwqeWLSZKChwNrZDnxRxS/8S4Y2tZXCbD3OHF94A0StA==', 'MeJmrA3t2wN22zPQbF6LGljI6mma/wzWgXRLBnmpGrKFy09VXX7w9VFzgi3uhSBCiDdNOzJne7PcCT3/WbxjRA==', 'jcoYgrM3u3/A7qdCzvc1ZdbTufnsCqeFrlYe+jaAgekpyJPzH0bVoBVyQgpo6m5bY68y2sKMPSYtt2FpKYm3TN3wVlTaq65V2owIib9nvNo=', 'wwmU4qtPdidTmAlyxmUIVew9SOKdm0uZPPTPnudibvUJNfjBfMwV/Mrcav7Nq+0uvcEZGE6PRErdp5OUSbc64e6ao3eKWgsLDGCthQFJmLs=', 'XXQ4aD8lpjbQwgtg5kYW20+f1v/Glq59QbIRW4jXcoPIGXoR2jILourDb/JGMAlHdvLYSA3acuax+7jiltWs5A=='

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\Client-built.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Client-built.exe	Mutant created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_zQ0poF2lHhCSZKSUZ3

Source: Client-built.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Client-built.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Client-built.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Client-built.exe	ReversingLabs: Detection: 84%
Source: Client-built.exe	Virustotal: Detection: 85%

Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Client-built.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Client-built.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_0100E33B push ebx; retf	0_2_0100E33E
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_010097C8 pushad ; retf	0_2_010097C9
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_063F6FB0 pushfd ; iretd	0_2_063F6FB9
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_063F4D34 push es; retf	0_2_063F4D48
Source: C:\Users\user\Desktop\Client-built.exe	Code function: 0_2_063F4D49 push es; retf	0_2_063F4D4C

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Client-built.exe

File opened: C:\Users\user\Desktop\Client-built.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe	Memory allocated: 1000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Memory allocated: 4B90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe TID: 7532

Thread sleep time: -45000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe

Last function: Thread delayed

Source: Client-built.exe, 00000000.00000002.2643125552.0000000000E66000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Client-built.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe	Queries volume information: C:\Users\user\Desktop\Client-built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Client-built.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: Client-built.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2643899248.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7528, type: MEMORYSTR

Remote Access Functionality

Detected Quasar RAT

Source: C:\Users\user\Desktop\Client-built.exe

Mutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_zQ0poF2lHhCSZKSUZ3

Jump to behavior

Yara detected Quasar RAT

Source: Yara match	File source: Client-built.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Client-built.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2643899248.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7528, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Obfuscated Files or Information	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	112 Application Layer Protocol	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Client-built.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
Client-built.exe	86%	Virustotal		Browse
Client-built.exe	100%	Avira	HEUR/AGEN.1307418
Client-built.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json/	false		high
R,,JA3V=g)s~	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://api.ipify.org/	Client-built.exe	false	high
http://freegeoip.net/xml/	Client-built.exe	false	high
http://schemas.datacontract.org/2004/07/	Client-built.exe, 00000000.00000002.2643899248.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Client-built.exe, 00000000.00000002.2643899248.0000000002BF7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	Client-built.exe, 00000000.00000002.2643899248.0000000002C0A000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000000.00000002.2643899248.0000000002BF7000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
20.107.53.25	unknown	United States		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579699
Start date and time:	2024-12-23 07:48:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Client-built.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 16 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	ip-api.com/json/?fields=225545
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse	ip-api.com/json/8.46.123.189?fields=192511
	main.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/8.46.123.189?fields=192511
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	ip-api.com/json/?fields=225545
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	8DiSW8IPEF.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	twE44mm07j.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	208.95.112.1
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse	208.95.112.1
	main.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	8DiSW8IPEF.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	twE44mm07j.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	208.95.112.1
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse	208.95.112.1
	main.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	HX Design.exe	Get hash	malicious	Python Stealer, Blank Grabber	Browse	208.95.112.1
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	208.95.112.1
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	fvbhdyuJYi.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	8DiSW8IPEF.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	twE44mm07j.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
MICROSOFT-CORP-MSN-AS-BLOCKUS	armv6l.elf	Get hash	malicious	Unknown	Browse	40.112.151.235
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	204.79.197.219
	armv4l.elf	Get hash	malicious	Unknown	Browse	20.202.12.183
	2.elf	Get hash	malicious	Unknown	Browse	20.78.208.111
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	20.208.252.17
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	20.234.251.100
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.152.225.5
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	40.113.41.15
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	21.84.149.231

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.428633025552722
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Client-built.exe
File size:	356'352 bytes
MD5:	beb1de229b374cd778107c8268e191ac
SHA1:	fb5dcf278195472e206fa484f7005aa485c308ae
SHA256:	604b99f997d7de70804667e6e985627485d1a4d1eb694f3c36a34f0a01aef7bd
SHA512:	62bbd4c5688438fb5b9d3610cc2fe2be654f4373a28fc116d6118d20b00c82060ac77d33c11758ef20b84a06a3eaced8a6eb9fe792a3a21207f1b37bb18caff0
SSDEEP:	6144:IzNHXf500MoXP4PcNINSzpbDGrnxD6JAwV5IO:6d50OCcxzAjR6qwV5IO
TLSH:	8E748D1373D4D63BD1FD173AE4320A194BB0D417BA16E38B5A5A65F82D133868E843B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ZUc.................b............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4581ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63555AB7 [Sun Oct 23 15:16:07 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x58180	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5a000	0xa00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x561d4	0x56200	a0e78fa06efc41008fc113c5be5adfb1	False	0.5131077648766328	data	6.4454137444965856	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5a000	0xa00	0xa00	76cc3230218ab47d3ced751a87f28c1b	False	0.340234375	data	4.23596538978674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5c000	0xc	0x200	3e9f7d609fdf085dc36811ecf2c51bd9	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5a090	0x2d4	data			0.43646408839779005
RT_MANIFEST	0x5a374	0x493	exported SGML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.43381725021349277

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T07:49:32.320518+0100	2036383	ET MALWARE Common RAT Connectivity Check Observed	1	192.168.2.8	49706	208.95.112.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:49:31.048646927 CET	49706	80	192.168.2.8	208.95.112.1
Dec 23, 2024 07:49:31.168162107 CET	80	49706	208.95.112.1	192.168.2.8
Dec 23, 2024 07:49:31.168241024 CET	49706	80	192.168.2.8	208.95.112.1
Dec 23, 2024 07:49:31.168694973 CET	49706	80	192.168.2.8	208.95.112.1
Dec 23, 2024 07:49:31.288161039 CET	80	49706	208.95.112.1	192.168.2.8
Dec 23, 2024 07:49:32.264566898 CET	80	49706	208.95.112.1	192.168.2.8
Dec 23, 2024 07:49:32.320518017 CET	49706	80	192.168.2.8	208.95.112.1
Dec 23, 2024 07:49:32.683785915 CET	49707	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:49:32.803438902 CET	25535	49707	20.107.53.25	192.168.2.8
Dec 23, 2024 07:49:32.803658962 CET	49707	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:49:54.700037956 CET	25535	49707	20.107.53.25	192.168.2.8
Dec 23, 2024 07:49:54.700171947 CET	49707	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:49:54.701953888 CET	49707	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:49:54.821408033 CET	25535	49707	20.107.53.25	192.168.2.8
Dec 23, 2024 07:49:59.368439913 CET	49710	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:49:59.488253117 CET	25535	49710	20.107.53.25	192.168.2.8
Dec 23, 2024 07:49:59.489830017 CET	49710	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:21.419081926 CET	25535	49710	20.107.53.25	192.168.2.8
Dec 23, 2024 07:50:21.419173002 CET	49710	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:21.419903994 CET	49710	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:21.539449930 CET	25535	49710	20.107.53.25	192.168.2.8
Dec 23, 2024 07:50:26.039855003 CET	49712	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:26.160103083 CET	25535	49712	20.107.53.25	192.168.2.8
Dec 23, 2024 07:50:26.160806894 CET	49712	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:33.454685926 CET	80	49706	208.95.112.1	192.168.2.8
Dec 23, 2024 07:50:33.454879045 CET	49706	80	192.168.2.8	208.95.112.1
Dec 23, 2024 07:50:48.075829983 CET	25535	49712	20.107.53.25	192.168.2.8
Dec 23, 2024 07:50:48.076195002 CET	49712	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:48.077281952 CET	49712	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:48.196906090 CET	25535	49712	20.107.53.25	192.168.2.8
Dec 23, 2024 07:50:52.852873087 CET	49713	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:50:52.972587109 CET	25535	49713	20.107.53.25	192.168.2.8
Dec 23, 2024 07:50:52.972692966 CET	49713	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:51:12.275211096 CET	49706	80	192.168.2.8	208.95.112.1
Dec 23, 2024 07:51:12.394975901 CET	80	49706	208.95.112.1	192.168.2.8
Dec 23, 2024 07:51:14.904405117 CET	25535	49713	20.107.53.25	192.168.2.8
Dec 23, 2024 07:51:14.904517889 CET	49713	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:51:14.905417919 CET	49713	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:51:15.024997950 CET	25535	49713	20.107.53.25	192.168.2.8
Dec 23, 2024 07:51:19.630722046 CET	49714	25535	192.168.2.8	20.107.53.25
Dec 23, 2024 07:51:19.750664949 CET	25535	49714	20.107.53.25	192.168.2.8
Dec 23, 2024 07:51:19.750785112 CET	49714	25535	192.168.2.8	20.107.53.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:49:30.621398926 CET	53690	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:49:30.758325100 CET	53	53690	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 07:49:30.621398926 CET	192.168.2.8	1.1.1.1	0xae31	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:49:30.758325100 CET	1.1.1.1	192.168.2.8	0xae31	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	208.95.112.1	80	7528	C:\Users\user\Desktop\Client-built.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 07:49:31.168694973 CET	144	OUT	GET /json/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 Host: ip-api.com Connection: Keep-Alive
Dec 23, 2024 07:49:32.264566898 CET	483	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:49:31 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	01:49:28
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Client-built.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Client-built.exe"
Imagebase:	0x790000
File size:	356'352 bytes
MD5 hash:	BEB1DE229B374CD778107C8268E191AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.2643899248.0000000002B91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: Quasar, Description: detect Remcos in memory, Source: 00000000.00000000.1385888862.0000000000792000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	97.7%
Signature Coverage:	0%
Total number of Nodes:	130
Total number of Limit Nodes:	10

Executed Functions

Function 01009C80 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886c2e2321f2ed55e82d15ba7e3e4157fb44161a86fe7cd12da9f9f4712666a3
Instruction ID: 6193a814a614d1ee895eca4a35d68dd9d959ec937a52d3e9d0de630486c8a8d6
Opcode Fuzzy Hash: 886c2e2321f2ed55e82d15ba7e3e4157fb44161a86fe7cd12da9f9f4712666a3
Instruction Fuzzy Hash: CEB17170E00209CFEB55DFA9C8857EDBBF2AF88318F148529E459E7295EB749841CB81

Function 0100A550 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d650ce24f1449e86a9e0e92b7f657835b072a8e9e47216e93f4f684fb5ea0be1
Instruction ID: bffc194c137521af5ed17b27fcbbdaa30114a550362d4d25c5b15dc486f87b77
Opcode Fuzzy Hash: d650ce24f1449e86a9e0e92b7f657835b072a8e9e47216e93f4f684fb5ea0be1
Instruction Fuzzy Hash: 24B15A70F00309CFEB55CFA9C8857AEBBF2BF88710F148529D455A7294EB749941CB81

Function 063F04F3 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 063F0756

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fa24b54abc4b41d4bba11b14624aae4ee7598fe62aeacf5d1da90445f7f158c1
Instruction ID: bbc768523703baaf72d583c71b9c8d2ec1d4be72d1a2397a1a75052454dc8b40
Opcode Fuzzy Hash: fa24b54abc4b41d4bba11b14624aae4ee7598fe62aeacf5d1da90445f7f158c1
Instruction Fuzzy Hash: B5815870A10B058FD7A8DF29D45475ABBF1FF88200F00892DE59AD7A51D774E949CFA0

Function 06410048 Relevance: 1.7, Strings: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?, xrefs: 064100AF

Memory Dump Source

Source File: 00000000.00000002.2645733785.0000000006410000.00000040.00000800.00020000.00000000.sdmp, Offset: 06410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6410000_Client-built.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: ea2c694ba4bebf35103f18389b181083c2f30cadf884b531946f9c3226f51099
Instruction ID: 3c0f4f773f2f2ebd731828bae22cc4219e7d765846384c720f69eaa2b606bb95
Opcode Fuzzy Hash: ea2c694ba4bebf35103f18389b181083c2f30cadf884b531946f9c3226f51099
Instruction Fuzzy Hash: E6F18C30B002089FEB59DBA5D944B6EBBB2FF85B00F14805AE4068F395CF759D82DB91

Function 063F26C4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 063F27E2

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2b3daac4d872fbf47c6ef18c27421a2010ba410ec1c2b73c2497323c4f5eac94
Instruction ID: edb6b6eedeae59873fad5945b853d7dc8084a57da1c74200821e27d2460bddcf
Opcode Fuzzy Hash: 2b3daac4d872fbf47c6ef18c27421a2010ba410ec1c2b73c2497323c4f5eac94
Instruction Fuzzy Hash: 0951D0B5D10349DFDB14CFA9C880ADEBBF6BF88310F24812AE818AB250D7759945CF90

Function 063F26D0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 063F27E2

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5910b20ed64f3c82b38b2ac7c9bf7cb4fbd3f71db4e86eebfc0d20e26234f762
Instruction ID: 9562cd4e218859372adc2068b118a1d53c196a5700cc2eb016e6bbd43cdf262e
Opcode Fuzzy Hash: 5910b20ed64f3c82b38b2ac7c9bf7cb4fbd3f71db4e86eebfc0d20e26234f762
Instruction Fuzzy Hash: AD41CFB1D10349DFDB14DF9AC884ADEBBB5FF88310F24812AE918AB250D7759945CF90

Function 01003334 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010033F1

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a3bead4e6900ae1dc954e3bbe81fed73c04203239698fea54029dd89ff1ff1dc
Instruction ID: 9f00a09e1b046e490d467e97442441ea8628756e501f15883205e1f480627fca
Opcode Fuzzy Hash: a3bead4e6900ae1dc954e3bbe81fed73c04203239698fea54029dd89ff1ff1dc
Instruction Fuzzy Hash: E74125B1C00319CFEB26DFA9C844BDDBBB1BF89704F20805AD448AB251CB756945CF90

Function 01001978 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010033F1

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 13b4e889a5adfeec91b8ddd245a36f9116815043ad37bbe870195190ea505f67
Instruction ID: b5018d2ef659917e6c1f4465337a5541be2302922a4f5fd21a11b28f0c63d726
Opcode Fuzzy Hash: 13b4e889a5adfeec91b8ddd245a36f9116815043ad37bbe870195190ea505f67
Instruction Fuzzy Hash: 6241E1B0D00719CFEB25DFAAC84479EBBF1BF89704F20806AD448AB251DB756945CF90

Function 063F4E20 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 063F4EE1

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e76521e6e99ae00b1c15c2fef038ed59d9ba1ea7074606b5e73780d40754a686
Instruction ID: 1fe07edc26a08ed270b0ced067e9d2e8e8bd2523debe4a18fbc1a01d750e6ec3
Opcode Fuzzy Hash: e76521e6e99ae00b1c15c2fef038ed59d9ba1ea7074606b5e73780d40754a686
Instruction Fuzzy Hash: B64116B5910309CFDB54DF99C848AABBBF5FB88314F24C459E519AB322D774A841CFA0

Function 0100F928 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,0100FC45), ref: 0100FCC8

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 869e4f02bc7a56560c56e033d7dcb1e8e8230bb7c7d3080c7fd4245a204e8235
Instruction ID: 1cb25fd65738826d68c9e83916ac6f829bed218b0540e6b3cac539602b726ce5
Opcode Fuzzy Hash: 869e4f02bc7a56560c56e033d7dcb1e8e8230bb7c7d3080c7fd4245a204e8235
Instruction Fuzzy Hash: 212149B1C0065E9BDB24DF9AC545B9EFBF4EB48620F108129D958A7380D338A944CFA1

Function 0100FC53 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,0100FC45), ref: 0100FCC8

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 56c769c143c6528ad7f8ad20136bc27d4f997e89ac919aef00d694ee50e7fa09
Instruction ID: e179fc6864f821e98d187945524379632f05aaca4e3c0cfbef23a2eca8a6074d
Opcode Fuzzy Hash: 56c769c143c6528ad7f8ad20136bc27d4f997e89ac919aef00d694ee50e7fa09
Instruction Fuzzy Hash: EB2138B1C0065E9BDB24DF9AC545B9EFBF4EF48720F14812AD858A7340D738A944CFA5

Function 063F7338 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 063F7395

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8d4f7ad456f72ade40171efed3496e0c946fed5d3df659c8dd63c4614ded9f7a
Instruction ID: af02bce082a1bb2bb7b98e8bbee123c286010c302bfc0a7ab009af3a81c17f3e
Opcode Fuzzy Hash: 8d4f7ad456f72ade40171efed3496e0c946fed5d3df659c8dd63c4614ded9f7a
Instruction Fuzzy Hash: 621145B58003498FCB20DFAAD845BCEFBF8EB48324F24841AE558A7340C378A544CFA1

Function 063F06F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 063F0756

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 96d3aee01940f9013865f6d549363ac12987833a39865ea134cfb05058619a12
Instruction ID: 67616e0ef38ebfa5cb730ac89e347727e1c4601e990d933dd0f7ea0cb2cca061
Opcode Fuzzy Hash: 96d3aee01940f9013865f6d549363ac12987833a39865ea134cfb05058619a12
Instruction Fuzzy Hash: 931113B5C003498FDB14DF9AC844BDEFBF4AB88220F10845AD519B7200C375A549CFA1

Function 063F6430 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 063F7395

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 982ac46b8ca5037e1c0245aad50462a760734d04b9752d552ba9fe2b92046d92
Instruction ID: 7ba3033a0b8fa8bd41f23d632cbbb2b075f2897a09eb37800ce977589332772b
Opcode Fuzzy Hash: 982ac46b8ca5037e1c0245aad50462a760734d04b9752d552ba9fe2b92046d92
Instruction Fuzzy Hash: 661148B58103488FDB20DF9AD844B9EFBF8EB48220F10841AD518A7700C374A944CFE5

Function 00DBD128 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642985984.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e0203f8354f4eeb345a0aa79765774463ad9465089d4c34bbfb55395e2ebaa
Instruction ID: f13e61c7d108fdb60e0d025efa7ad46aba8ee97bff66ac7ff60134a56d76212f
Opcode Fuzzy Hash: c2e0203f8354f4eeb345a0aa79765774463ad9465089d4c34bbfb55395e2ebaa
Instruction Fuzzy Hash: 492122B1604344DFEB04DF18D9C4B26BB66FB84314F24C56DD84A4B286D33AD846CB71

Function 00DBD123 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2642985984.0000000000DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dbd000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: d37bdbdcf270688c3d81d8e320a008765a789f5e8cd38ae3a849e9634be127d5
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 6211BE75504284CFCB01CF14D5C4B15BB62FB44324F28C6ADDC4A4B656D33AD80ACB61

Non-executed Functions

Function 063F0BD8 Relevance: .5, Instructions: 530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 228ee51622971f69fdfd4f41eda680caf930e17f479b687481f2fc2cf086d161
Instruction ID: bec31bdf09caee799955a8b56b6a30649097a2261fae7c6c5d74c50997bdc908
Opcode Fuzzy Hash: 228ee51622971f69fdfd4f41eda680caf930e17f479b687481f2fc2cf086d161
Instruction Fuzzy Hash: AD5216B1510B0ACFD724CF28F88C1997BB1FB81318F904719D6696B2A9D7B4658BCF84

Function 063F7558 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2645691952.00000000063F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_63f0000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a9e26945bcd8a00f4de6b49ecdb84ab8549989027e5323e998efb950ca1fb5
Instruction ID: c33dcc009ce96362af00e159d4b1febe7599fad3d72d37b12cd2a5b5f1e9cafb
Opcode Fuzzy Hash: 86a9e26945bcd8a00f4de6b49ecdb84ab8549989027e5323e998efb950ca1fb5
Instruction Fuzzy Hash: 6FF12830E103098FEB54DFA9D944B9DBBF1BF88304F158169E509AB3A5DB70E949CB90

Function 01009938 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2643357622.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2ae1d858b61735c6046634a9044988fe74c0b835e75554bd1a9258f7b2be33
Instruction ID: 5386d9728e4bddded8824bf10f235e01b03f2636425d256a522c192914740f78
Opcode Fuzzy Hash: 8a2ae1d858b61735c6046634a9044988fe74c0b835e75554bd1a9258f7b2be33
Instruction Fuzzy Hash: 3B918170E00209CFEF55DFA9C9817DDBBF2BF88718F148129E449A7295EB749885CB81

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Client-built.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
Client-built.exe

Function 063F04F3 Relevance: 1.7, APIs: 1, Instructions: 208
COMMON

Function 06410048 Relevance: 1.7, Strings: 1, Instructions: 426
COMMON

Function 063F26C4 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 063F26D0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 01003334 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Function 01001978 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 063F4E20 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0100F928 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Function 0100FC53 Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 063F7338 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Function 063F06F0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 063F6430 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON