Edit tour

Windows Analysis Report
wUSt04rfJ0.exe

Overview

General Information

Sample name:	wUSt04rfJ0.exe renamed because original name is a hash value
Original sample name:	87b488fc8f9760bc9182c32ef76be93c.exe
Analysis ID:	1580465
MD5:	87b488fc8f9760bc9182c32ef76be93c
SHA1:	16c3c1c53963cfedb800515b70e27ca2b7dd79fd
SHA256:	457e291dc62946ab2dc1cb558ffca2e90e5ebbd4a27013c5a23930339aedb978
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Quasar

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to detect virtual machines (STR)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

wUSt04rfJ0.exe (PID: 6228 cmdline: "C:\Users\user\Desktop\wUSt04rfJ0.exe" MD5: 87B488FC8F9760BC9182C32EF76BE93C)

schtasks.exe (PID: 6328 cmdline: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Client.exe (PID: 2180 cmdline: "C:\Windows\system32\SubDir\Client.exe" MD5: 87B488FC8F9760BC9182C32EF76BE93C)

schtasks.exe (PID: 5296 cmdline: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Client.exe (PID: 4208 cmdline: C:\Windows\system32\SubDir\Client.exe MD5: 87B488FC8F9760BC9182C32EF76BE93C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "43.138.147.74:4782;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "4b095ece-017a-46f8-874b-d1266394fa10", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "SLY8FRW0tXeaPgqaf9SkUic9Zx6b8Xd4mrxIID83zGoHDeZuQXEstPb4ajE1EfBc1lVoJEU/jZIYKi59Ye8ztLFs061H9IjQxRoVSzR4oyRaJe2eEsqBfPNFwnxag1zDsRHAmZZsnB51NPUCITo/13eD0VGdrc+2aecOf9BZP7nSew981KlAxDx9AqrfeeQkTZ/gJdS2dni757ZyiP0xZF6JCDEevNZXz4aOlG9PviI1vrCS1k7MMYxElvDjh/iOE3r1aRtCFPm10me5rn5bjfDJXVvPDHXVbRuRKdqowlMRaw9cAK0h8O8VKIewNipYRaSRYGnBivEn6yibbbLEQG+Rts0v5bFqIIgnqxPtJdeyteleLqwDCvyJlY4I06Nee/bZ2IbziMtLLP2CHVdjLL6FAttN1P0mZMLjQGfMsVu96/nzU3yyKG5q3i2I6pAP/c4qeJnaDaSCdXeF6qxXjXuDdUeMOCVD//SVYeNJrOlGoccGH+5wiiIQUjLYjN9yFjfMLCJoHqFrT2RPdeUeTwBvVeotIepljzX8GF8OU/w+LQeIXE3YGNCFno43T4lEXIl40EwxG8Z130RFVEI8vBv731FojXkxHeyZGKEZ3R0VAGUl8wuTqXP7noX1jYPqsflj8hexHd6zDYCY4zwbeAg2Tj3A5N6L5PUAFBev6Ns=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMjUUqH2Alkgj6YxbPxN7TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIxNjAyMTAyOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAi40xpvzEk985YOpDfNu2mnZQ0jDHJ2sbkOStKxkJatyEfD4vI7dxrEDFwSfqgMPcEun6IcClh1P8vTgy3nJ9LfDHFMFxEmQ8J1XHnHtIR4LoiDxZSTWz4iaJbRumwxNqcEmL0mB0AEbB6xoaahkK0nbOBAhiRLBjP0dGXVhB+Uu+kfe9ImwSaQzDYhJTJE4SiJXgrGUzBdkwZaBdwv2toUD3BEPbYFYUC3OK5p5csegN1ymJuAjDXVCPccTRJaoouMZ9OZdeaqUWVG/iQ8wB1e7dAyqJzexfGgIKQQ429JfCy4w3r3vJpwD2utNW7mOBwh2iaXHW57+OUK1ijJ/MrF1KXQ1gB0akBz2Xk6Sph/n7G2WxIPGgOwdPED+vl3RQRNfzN9RgfxzexML9lUYaOAp1Isx7ARkd8dR9sqc8CntTftY+za6R9b+clXlCfg88rWkUh67kMwOyLtJcfYuLkpqpFo8F7O3bukjnAkBXByhTwvk2TIMAoq5Rtu0FcjHsqdSzVRYscvwoF3eZ66LNIAUjubIHok3yd8kiHHGy7l4GzalRH4iv+czyhMxbPW5L55e53h3D/2eHtSM0fIYWoRJoWIswyM0L6RJ/WxG/0HfNsB62BelqUXHslXun9DrIZFKBQ5x3h/p4nLQ343VLSD39C8wXWpK3tilpUa2raWcCAwEAAaMyMDAwHQYDVR0OBBYEFIe//4uhDpaSAPnxGdItJGKuvOTIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACCSNPmM886pOW78ePc2anr27lE8o8fVY0kKOSl1wDwv4DcHW0C5aXMeNvw58hJ2OzBxuBZ/+a43gcQouMqUztub798n9Atrdnc1abCyYl50TvYlQqcJJEtoiazZKP7JZtyXFsk2GOVfD9nf9V5pyd3lSThj0SxA+yasczQSV3C0FkHarn9CaYOYvJOk2UOgiG6HsnQgPAToVGOrmsAK+P8x9yMCbCJHAZ/jGEyFEHS+ml7HiqYK678xwTIShqgQo6aIFJwga33zgLzXwwxySBDhOvblNkPLYxsRLAFBQ9iBW4bdDnmWyTuokzXyV4e15VpejO59hFNpNb4rF0a4ZCdNK7MTUnkIulziyFzQa/qOj8po0JUI0jmaiPXTEuxlrZ+9wZlxVqq21OqStmWC/GBBSCG/YyVrt6j4IulEjL2VMtV7vSo52MTGexI/EqtISLuKCl4AsLIpTyl+qt6lqE8C3LzfKZCpz0p1xB1UU9kv52WrHeeYoW/ZxSnHDeQfQ6/K+NyKMwgtPnQlKErU8rgh3wO4YpIfOl5UbCuBxvoUZdI4rWl/9a3PLzyyN6w4bBmLclwuk6wgezIT6R+A4pqCBWzJYud8Ftebk3ZtnlYKSyZGkeLoxGTlj+S/NYFG1630oPBORpJ0nOGDPVjBl7MVjh3TdlMx9khDFrgF9VnU"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wUSt04rfJ0.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
wUSt04rfJ0.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
wUSt04rfJ0.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed6:$x1: Quasar.Common.Messages 0x29f1ff:$x1: Quasar.Common.Messages 0x2ab822:$x4: Uninstalling... good bye :-( 0x2ad017:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
wUSt04rfJ0.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadd4:$f1: FileZilla\recentservers.xml 0x2aae14:$f2: FileZilla\sitemanager.xml 0x2aae56:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0a2:$b1: Chrome\User Data\ 0x2ab0f8:$b1: Chrome\User Data\ 0x2ab3d0:$b2: Mozilla\Firefox\Profiles 0x2ab4cc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd450:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab624:$b4: Opera Software\Opera Stable\Login Data 0x2ab6de:$b5: YandexBrowser\User Data\ 0x2ab74c:$b5: YandexBrowser\User Data\ 0x2ab420:$s4: logins.json 0x2ab156:$a1: username_value 0x2ab174:$a2: password_value 0x2ab460:$a3: encryptedUsername 0x2fd394:$a3: encryptedUsername 0x2ab484:$a4: encryptedPassword 0x2fd3b2:$a4: encryptedPassword 0x2fd330:$a5: httpRealm
wUSt04rfJ0.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab90c:$s3: Process already elevated. 0x28ebd5:$s4: get_PotentiallyVulnerablePasswords 0x278c91:$s5: GetKeyloggerLogsDirectory 0x29e95e:$s5: GetKeyloggerLogsDirectory 0x28ebf8:$s6: set_PotentiallyVulnerablePasswords 0x2fea7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\System32\SubDir\Client.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Windows\System32\SubDir\Client.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\System32\SubDir\Client.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed6:$x1: Quasar.Common.Messages 0x29f1ff:$x1: Quasar.Common.Messages 0x2ab822:$x4: Uninstalling... good bye :-( 0x2ad017:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Windows\System32\SubDir\Client.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadd4:$f1: FileZilla\recentservers.xml 0x2aae14:$f2: FileZilla\sitemanager.xml 0x2aae56:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0a2:$b1: Chrome\User Data\ 0x2ab0f8:$b1: Chrome\User Data\ 0x2ab3d0:$b2: Mozilla\Firefox\Profiles 0x2ab4cc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd450:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab624:$b4: Opera Software\Opera Stable\Login Data 0x2ab6de:$b5: YandexBrowser\User Data\ 0x2ab74c:$b5: YandexBrowser\User Data\ 0x2ab420:$s4: logins.json 0x2ab156:$a1: username_value 0x2ab174:$a2: password_value 0x2ab460:$a3: encryptedUsername 0x2fd394:$a3: encryptedUsername 0x2ab484:$a4: encryptedPassword 0x2fd3b2:$a4: encryptedPassword 0x2fd330:$a5: httpRealm
C:\Windows\System32\SubDir\Client.exe	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab90c:$s3: Process already elevated. 0x28ebd5:$s4: get_PotentiallyVulnerablePasswords 0x278c91:$s5: GetKeyloggerLogsDirectory 0x29e95e:$s5: GetKeyloggerLogsDirectory 0x28ebf8:$s6: set_PotentiallyVulnerablePasswords 0x2fea7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1683183819.000002358E630000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1700864870.0000002C9A079000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1683288087.000002358E8A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1683183819.000002358E638000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1683288087.000002358E8A5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.1682021700.0000006DD9BC9000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1701012331.0000014C2ACF0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1700972758.0000014C2ACC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1701012331.0000014C2ACF9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.1700972758.0000014C2ACC5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000004.00000002.1718959014.00000000027E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1664340206.0000000000A22000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: wUSt04rfJ0.exe PID: 6228	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: schtasks.exe PID: 6328	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client.exe PID: 2180	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client.exe PID: 4208	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: schtasks.exe PID: 5296	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.wUSt04rfJ0.exe.a20000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.wUSt04rfJ0.exe.a20000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.wUSt04rfJ0.exe.a20000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28eed6:$x1: Quasar.Common.Messages 0x29f1ff:$x1: Quasar.Common.Messages 0x2ab822:$x4: Uninstalling... good bye :-( 0x2ad017:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.wUSt04rfJ0.exe.a20000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadd4:$f1: FileZilla\recentservers.xml 0x2aae14:$f2: FileZilla\sitemanager.xml 0x2aae56:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0a2:$b1: Chrome\User Data\ 0x2ab0f8:$b1: Chrome\User Data\ 0x2ab3d0:$b2: Mozilla\Firefox\Profiles 0x2ab4cc:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd450:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab624:$b4: Opera Software\Opera Stable\Login Data 0x2ab6de:$b5: YandexBrowser\User Data\ 0x2ab74c:$b5: YandexBrowser\User Data\ 0x2ab420:$s4: logins.json 0x2ab156:$a1: username_value 0x2ab174:$a2: password_value 0x2ab460:$a3: encryptedUsername 0x2fd394:$a3: encryptedUsername 0x2ab484:$a4: encryptedPassword 0x2fd3b2:$a4: encryptedPassword 0x2fd330:$a5: httpRealm
0.0.wUSt04rfJ0.exe.a20000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab90c:$s3: Process already elevated. 0x28ebd5:$s4: get_PotentiallyVulnerablePasswords 0x278c91:$s5: GetKeyloggerLogsDirectory 0x29e95e:$s5: GetKeyloggerLogsDirectory 0x28ebf8:$s6: set_PotentiallyVulnerablePasswords 0x2fea7e:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

AV Detection

Sigma detected: Quasar

Source: Process started

Author: Joe Security: Data: Command: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\wUSt04rfJ0.exe", ParentImage: C:\Users\user\Desktop\wUSt04rfJ0.exe, ParentProcessId: 6228, ParentProcessName: wUSt04rfJ0.exe, ProcessCommandLine: "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f, ProcessId: 6328, ProcessName: schtasks.exe

E-Banking Fraud

Sigma detected: Quasar

Source: Process started

Stealing of Sensitive Information

Sigma detected: Quasar

Source: Process started

Remote Access Functionality

Sigma detected: Quasar

Source: Process started

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T16:32:03.212960+0100	2035595	1	Domain Observed Used for C2 Detected	43.138.147.74	4782	192.168.2.4	49730	TCP

ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T16:32:03.212960+0100	2027619	1	Domain Observed Used for C2 Detected	43.138.147.74	4782	192.168.2.4	49730	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: wUSt04rfJ0.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\System32\SubDir\Client.exe

Avira: detection malicious, Label: HEUR/AGEN.1307453

Found malware configuration

Source: wUSt04rfJ0.exe

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "43.138.147.74:4782;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "4b095ece-017a-46f8-874b-d1266394fa10", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "SLY8FRW0tXeaPgqaf9SkUic9Zx6b8Xd4mrxIID83zGoHDeZuQXEstPb4ajE1EfBc1lVoJEU/jZIYKi59Ye8ztLFs061H9IjQxRoVSzR4oyRaJe2eEsqBfPNFwnxag1zDsRHAmZZsnB51NPUCITo/13eD0VGdrc+2aecOf9BZP7nSew981KlAxDx9AqrfeeQkTZ/gJdS2dni757ZyiP0xZF6JCDEevNZXz4aOlG9PviI1vrCS1k7MMYxElvDjh/iOE3r1aRtCFPm10me5rn5bjfDJXVvPDHXVbRuRKdqowlMRaw9cAK0h8O8VKIewNipYRaSRYGnBivEn6yibbbLEQG+Rts0v5bFqIIgnqxPtJdeyteleLqwDCvyJlY4I06Nee/bZ2IbziMtLLP2CHVdjLL6FAttN1P0mZMLjQGfMsVu96/nzU3yyKG5q3i2I6pAP/c4qeJnaDaSCdXeF6qxXjXuDdUeMOCVD//SVYeNJrOlGoccGH+5wiiIQUjLYjN9yFjfMLCJoHqFrT2RPdeUeTwBvVeotIepljzX8GF8OU/w+LQeIXE3YGNCFno43T4lEXIl40EwxG8Z130RFVEI8vBv731FojXkxHeyZGKEZ3R0VAGUl8wuTqXP7noX1jYPqsflj8hexHd6zDYCY4zwbeAg2Tj3A5N6L5PUAFBev6Ns=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMjUUqH2Alkgj6YxbPxN7TANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIxNjAyMTAyOVoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAi40xpvzEk985YOpDfNu2mnZQ0jDHJ2sbkOStKxkJatyEfD4vI7dxrEDFwSfqgMPcEun6IcClh1P8vTgy3nJ9LfDHFMFxEmQ8J1XHnHtIR4LoiDxZSTWz4iaJbRumwxNqcEmL0mB0AEbB6xoaahkK0nbOBAhiRLBjP0dGXVhB+Uu+kfe9ImwSaQzDYhJTJE4SiJXgrGUzBdkwZaBdwv2toUD3BEPbYFYUC3OK5p5csegN1ymJuAjDXVCPccTRJaoouMZ9OZdeaqUWVG/iQ8wB1e7dAyqJzexfGgIKQQ429JfCy4w3r3vJpwD2utNW7mOBwh2iaXHW57+OUK1ijJ/MrF1KXQ1gB0akBz2Xk6Sph/n7G2WxIPGgOwdPED+vl3RQRNfzN9RgfxzexML9lUYaOAp1Isx7ARkd8dR9sqc8CntTftY+za6R9b+clXlCfg88rWkUh67kMwOyLtJcfYuLkpqpFo8F7O3bukjnAkBXByhTwvk2TIMAoq5Rtu0FcjHsqdSzVRYscvwoF3eZ66LNIAUjubIHok3yd8kiHHGy7l4GzalRH4iv+czyhMxbPW5L55e53h3D/2eHtSM0fIYWoRJoWIswyM0L6RJ/WxG/0HfNsB62BelqUXHslXun9DrIZFKBQ5x3h/p4nLQ343VLSD39C8wXWpK3tilpUa2raWcCAwEAAaMyMDAwHQYDVR0OBBYEFIe//4uhDpaSAPnxGdItJGKuvOTIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBACCSNPmM886pOW78ePc2anr27lE8o8fVY0kKOSl1wDwv4DcHW0C5aXMeNvw58hJ2OzBxuBZ/+a43gcQouMqUztub798n9Atrdnc1abCyYl50TvYlQqcJJEtoiazZKP7JZtyXFsk2GOVfD9nf9V5pyd3lSThj0SxA+yasczQSV3C0FkHarn9CaYOYvJOk2UOgiG6HsnQgPAToVGOrmsAK+P8x9yMCbCJHAZ/jGEyFEHS+ml7HiqYK678xwTIShqgQo6aIFJwga33zgLzXwwxySBDhOvblNkPLYxsRLAFBQ9iBW4bdDnmWyTuokzXyV4e15VpejO59hFNpNb4rF0a4ZCdNK7MTUnkIulziyFzQa/qOj8po0JUI0jmaiPXTEuxlrZ+9wZlxVqq21OqStmWC/GBBSCG/YyVrt6j4IulEjL2VMtV7vSo52MTGexI/EqtISLuKCl4AsLIpTyl+qt6lqE8C3LzfKZCpz0p1xB1UU9kv52WrHeeYoW/ZxSnHDeQfQ6/K+NyKMwgtPnQlKErU8rgh3wO4YpIfOl5UbCuBxvoUZdI4rWl/9a3PLzyyN6w4bBmLclwuk6wgezIT6R+A4pqCBWzJYud8Ftebk3ZtnlYKSyZGkeLoxGTlj+S/NYFG1630oPBORpJ0nOGDPVjBl7MVjh3TdlMx9khDFrgF9VnU"}

Multi AV Scanner detection for dropped file

Source: C:\Windows\System32\SubDir\Client.exe

ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: wUSt04rfJ0.exe

ReversingLabs: Detection: 76%

Yara detected Quasar RAT

Source: Yara match	File source: wUSt04rfJ0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700864870.0000002C9A079000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682021700.0000006DD9BC9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1718959014.00000000027E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1664340206.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wUSt04rfJ0.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 2180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\System32\SubDir\Client.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: wUSt04rfJ0.exe

Joe Sandbox ML: detected

Source: wUSt04rfJ0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 108.181.61.49:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: wUSt04rfJ0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027619 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (Quasar CnC) : 43.138.147.74:4782 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 43.138.147.74:4782 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 43.138.147.74

Yara detected Generic Downloader

Source: Yara match	File source: wUSt04rfJ0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 43.138.147.74:4782

Source: Joe Sandbox View

IP Address: 108.181.61.49 108.181.61.49

Source: Joe Sandbox View

ASN Name: LILLY-ASUS LILLY-ASUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	TCP traffic detected without corresponding DNS query: 43.138.147.74
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ipwho.is

Source: Client.exe, 00000003.00000002.2918043161.000000001B622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Client.exe, 00000003.00000002.2911724947.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.3.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Client.exe, 00000003.00000002.2912584091.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipwho.is
Source: Client.exe, 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: wUSt04rfJ0.exe, 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wUSt04rfJ0.exe, Client.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: Client.exe, 00000003.00000002.2912584091.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: wUSt04rfJ0.exe, Client.exe.0.dr	String found in binary or memory: https://ipwho.is/
Source: wUSt04rfJ0.exe, Client.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: wUSt04rfJ0.exe, Client.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: wUSt04rfJ0.exe, Client.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 108.181.61.49:443 -> 192.168.2.4:49732 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\System32\SubDir\Client.exe

Windows user hook set: 0 keyboard low level C:\Windows\system32\SubDir\Client.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: wUSt04rfJ0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700864870.0000002C9A079000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682021700.0000006DD9BC9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1718959014.00000000027E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1664340206.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wUSt04rfJ0.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 2180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: wUSt04rfJ0.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: wUSt04rfJ0.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: wUSt04rfJ0.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	File created: C:\Windows\system32\SubDir			Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	File created: C:\Windows\system32\SubDir\Client.exe			Jump to behavior

Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA77C16	3_2_00007FFD9BA77C16
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA7EB29	3_2_00007FFD9BA7EB29
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA69271	3_2_00007FFD9BA69271
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA7CAD5	3_2_00007FFD9BA7CAD5
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA78A0F	3_2_00007FFD9BA78A0F
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA6AFDD	3_2_00007FFD9BA6AFDD
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA7B851	3_2_00007FFD9BA7B851
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA69FD0	3_2_00007FFD9BA69FD0
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA655D6	3_2_00007FFD9BA655D6
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA6621F	3_2_00007FFD9BA6621F
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BB82321	3_2_00007FFD9BB82321

Source: wUSt04rfJ0.exe, 00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs wUSt04rfJ0.exe
Source: wUSt04rfJ0.exe, 00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe. vs wUSt04rfJ0.exe
Source: wUSt04rfJ0.exe	Binary or memory string: OriginalFilenameClient.exe. vs wUSt04rfJ0.exe

Source: wUSt04rfJ0.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: wUSt04rfJ0.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: wUSt04rfJ0.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: wUSt04rfJ0.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/5@1/2

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wUSt04rfJ0.exe.log

Jump to behavior

Source: C:\Windows\System32\SubDir\Client.exe	Mutant created: NULL
Source: C:\Windows\System32\SubDir\Client.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\4b095ece-017a-46f8-874b-d1266394fa10
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3912:120:WilError_03

Source: wUSt04rfJ0.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: wUSt04rfJ0.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\System32\SubDir\Client.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wUSt04rfJ0.exe

ReversingLabs: Detection: 76%

Source: wUSt04rfJ0.exe

String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

File read: C:\Users\user\Desktop\wUSt04rfJ0.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\wUSt04rfJ0.exe "C:\Users\user\Desktop\wUSt04rfJ0.exe"
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process created: C:\Windows\System32\SubDir\Client.exe "C:\Windows\system32\SubDir\Client.exe"
Source: unknown	Process created: C:\Windows\System32\SubDir\Client.exe C:\Windows\system32\SubDir\Client.exe
Source: C:\Windows\System32\SubDir\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process created: C:\Windows\System32\SubDir\Client.exe "C:\Windows\system32\SubDir\Client.exe"	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: wUSt04rfJ0.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: wUSt04rfJ0.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: wUSt04rfJ0.exe

Static file information: File size 3266048 > 1048576

Source: wUSt04rfJ0.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c600

Source: wUSt04rfJ0.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Code function: 0_2_00007FFD9B7C00AD pushad ; iretd	0_2_00007FFD9B7C00C1
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9B6DEECF push ebx; ret	3_2_00007FFD9B6DEEDA
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9B6DEF45 push ebx; ret	3_2_00007FFD9B6DEF46
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9B6DD2A5 pushad ; iretd	3_2_00007FFD9B6DD2A6
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9B7F2BE5 pushad ; iretd	3_2_00007FFD9B7F2C3D
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9B7F2BB0 pushad ; iretd	3_2_00007FFD9B7F2C3D
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9B7F00AD pushad ; iretd	3_2_00007FFD9B7F00C1
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BA6336E push eax; ret	3_2_00007FFD9BA6340C
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 3_2_00007FFD9BB82321 push edx; retf 5F1Eh	3_2_00007FFD9BB85A3B
Source: C:\Windows\System32\SubDir\Client.exe	Code function: 4_2_00007FFD9B7F00AD pushad ; iretd	4_2_00007FFD9B7F00C1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

Executable created and started: C:\Windows\system32\SubDir\Client.exe

Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

File created: C:\Windows\System32\SubDir\Client.exe

Jump to dropped file

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

File created: C:\Windows\System32\SubDir\Client.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	File opened: C:\Users\user\Desktop\wUSt04rfJ0.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	File opened: C:\Windows\system32\SubDir\Client.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	File opened: C:\Windows\system32\SubDir\Client.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Memory allocated: 1B060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Memory allocated: 1AC10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Memory allocated: D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Memory allocated: 1A7B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\SubDir\Client.exe

Code function: 3_2_00007FFD9B7FF1F2 str ax

3_2_00007FFD9B7FF1F2

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\SubDir\Client.exe	Window / User API: threadDelayed 2028			Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Window / User API: threadDelayed 7759			Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe TID: 6392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe TID: 6956	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe TID: 6956	Thread sleep time: -30437127721620741s >= -30000s	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe TID: 4348	Thread sleep count: 2028 > 30	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe TID: 4348	Thread sleep count: 7759 > 30	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe TID: 3732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe TID: 1448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\SubDir\Client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Windows\System32\SubDir\Client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\SubDir\Client.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Client.exe, 00000003.00000002.2918978789.000000001B964000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.2918043161.000000001B622000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000003.00000002.2918978789.000000001B9FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Process created: C:\Windows\System32\SubDir\Client.exe "C:\Windows\system32\SubDir\Client.exe"	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe	Queries volume information: C:\Users\user\Desktop\wUSt04rfJ0.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Queries volume information: C:\Windows\System32\SubDir\Client.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\SubDir\Client.exe	Queries volume information: C:\Windows\System32\SubDir\Client.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\wUSt04rfJ0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: wUSt04rfJ0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700864870.0000002C9A079000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682021700.0000006DD9BC9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1718959014.00000000027E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1664340206.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wUSt04rfJ0.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 2180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: wUSt04rfJ0.exe, type: SAMPLE
Source: Yara match	File source: 0.0.wUSt04rfJ0.exe.a20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700864870.0000002C9A079000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683183819.000002358E638000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1683288087.000002358E8A5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1682021700.0000006DD9BC9000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1701012331.0000014C2ACF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1700972758.0000014C2ACC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1718959014.00000000027E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1664340206.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wUSt04rfJ0.exe PID: 6228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 6328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 2180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: schtasks.exe PID: 5296, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\System32\SubDir\Client.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	121 Masquerading	11 Input Capture	111 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	51 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	23 System Information Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
wUSt04rfJ0.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
wUSt04rfJ0.exe	100%	Avira	HEUR/AGEN.1307453
wUSt04rfJ0.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\System32\SubDir\Client.exe	100%	Avira	HEUR/AGEN.1307453
C:\Windows\System32\SubDir\Client.exe	100%	Joe Sandbox ML
C:\Windows\System32\SubDir\Client.exe	76%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar

Source	Detection	Scanner	Label	Link
43.138.147.74	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipwho.is	108.181.61.49	true	false		high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.101	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
43.138.147.74	true	Avira URL Cloud: safe	unknown
https://ipwho.is/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org/	wUSt04rfJ0.exe, Client.exe.0.dr	false	high
https://stackoverflow.com/q/14436606/23354	wUSt04rfJ0.exe, Client.exe.0.dr	false	high
https://stackoverflow.com/q/2152978/23354sCannot	wUSt04rfJ0.exe, Client.exe.0.dr	false	high
http://schemas.datacontract.org/2004/07/	Client.exe, 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	wUSt04rfJ0.exe, 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ipwho.is	Client.exe, 00000003.00000002.2912584091.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	wUSt04rfJ0.exe, Client.exe.0.dr	false	high
https://ipwho.is	Client.exe, 00000003.00000002.2912584091.0000000002FD7000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
43.138.147.74	unknown	Japan		4249	LILLY-ASUS	true
108.181.61.49	ipwho.is	Canada		852	ASN852CA	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580465
Start date and time:	2024-12-24 16:31:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wUSt04rfJ0.exe renamed because original name is a hash value
Original Sample Name:	87b488fc8f9760bc9182c32ef76be93c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/5@1/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 91% Number of executed functions: 57 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.101, 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Client.exe, PID 4208 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: wUSt04rfJ0.exe

Simulations

Behavior and APIs

Time	Type	Description
10:32:01	API Interceptor	4156734x Sleep call for process: Client.exe modified
15:31:59	Task Scheduler	Run new task: Quasar Client Startup path: C:\Windows\system32\SubDir\Client.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
108.181.61.49	888.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	888.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json
	Cracker.exe	Get hash	malicious	Luca Stealer	Browse	/?output=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipwho.is	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	108.181.61.49
	StGx54oFh6.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	1AqzGcCKey.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	BJtvb5Vdhh.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	HquJT7q6xG.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	hKvlV6A1Rl.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	kqeGVKtpy2.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	LFLtlBAuf7.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	O9MV0lNEO5.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
	RegAsm.exe	Get hash	malicious	Quasar	Browse	108.181.61.49
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Unknown	Browse	217.20.58.99
	AxoPac.exe	Get hash	malicious	LummaC	Browse	217.20.58.100
	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	217.20.58.99
	PLEASE SIGN THIS DOCUMENT - Reference number(s) 0598190575 DPR.msg	Get hash	malicious	Unknown	Browse	217.20.58.101
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	217.20.58.99
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	217.20.58.100
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	217.20.58.99
	data.exe	Get hash	malicious	Unknown	Browse	217.20.58.99
	4hSuRTwnWJ.dll	Get hash	malicious	Unknown	Browse	217.20.58.100
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	217.20.58.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN852CA	armv7l.elf	Get hash	malicious	Unknown	Browse	75.155.145.0
	jklspc.elf	Get hash	malicious	Unknown	Browse	50.99.243.16
	splsh4.elf	Get hash	malicious	Unknown	Browse	207.34.140.144
	splmips.elf	Get hash	malicious	Unknown	Browse	142.241.147.185
	splx86.elf	Get hash	malicious	Unknown	Browse	199.126.48.47
	arm5.elf	Get hash	malicious	Unknown	Browse	137.186.136.207
	https://en.newsnowbangla.com/archives/69912	Get hash	malicious	HTMLPhisher, TechSupportScam	Browse	108.181.61.49
	armv5l.elf	Get hash	malicious	Unknown	Browse	172.219.191.249
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	108.181.20.35
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	50.99.128.40
LILLY-ASUS	armv6l.elf	Get hash	malicious	Unknown	Browse	40.58.152.80
	armv5l.elf	Get hash	malicious	Unknown	Browse	43.153.118.56
	splarm7.elf	Get hash	malicious	Unknown	Browse	40.18.117.254
	jklspc.elf	Get hash	malicious	Unknown	Browse	42.210.249.136
	splarm.elf	Get hash	malicious	Unknown	Browse	40.247.176.39
	nabm68k.elf	Get hash	malicious	Unknown	Browse	42.128.179.230
	nabarm.elf	Get hash	malicious	Unknown	Browse	43.17.48.198
	nklspc.elf	Get hash	malicious	Unknown	Browse	40.178.220.53
	ppc.elf	Get hash	malicious	Unknown	Browse	43.173.192.115
	nabarm7.elf	Get hash	malicious	Unknown	Browse	43.13.129.82

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	108.181.61.49
	gYjK72gL17.exe	Get hash	malicious	Stealc, Vidar	Browse	108.181.61.49
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	108.181.61.49
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	108.181.61.49
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	108.181.61.49
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	108.181.61.49
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	108.181.61.49
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	108.181.61.49
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	108.181.61.49
	WO.exe	Get hash	malicious	Metasploit	Browse	108.181.61.49

Process:	C:\Windows\System32\SubDir\Client.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\SubDir\Client.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1440865988908953
Encrypted:	false
SSDEEP:	6:kKSlL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:jDnLNkPlE99SNxAhUe/3
MD5:	D413963F2FD7938F3C519A5A86F5D7D9
SHA1:	BE838615F71F0C9137B3878120E2C5737708DA01
SHA-256:	32A6CAE1603878041578F9EF9298C1E76E4FE26703F67330913AAC484C7A1FDB
SHA-512:	83ACEB92584571E02AA5E68E95DB3CAA3C5A7DBCDBE9C5EF74C72E7895060306FE787786F815A6BCD8AC77669D0A0AEC82D1120375EE4FE69BA95B8E248B2BED
Malicious:	false
Reputation:	low
Preview:	p...... ........$....V..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Download File

Process:	C:\Windows\System32\SubDir\Client.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wUSt04rfJ0.exe.log

Download File

Process:	C:\Users\user\Desktop\wUSt04rfJ0.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Windows\System32\SubDir\Client.exe

Download File

Process:	C:\Users\user\Desktop\wUSt04rfJ0.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3266048
Entropy (8bit):	6.081652799630962
Encrypted:	false
SSDEEP:	49152:evQI22SsaNYfdPBldt698dBcjHaLA3qarWboGdmhIOTHHB72eh2NT:evt22SsaNYfdPBldt6+dBcjHN3c
MD5:	87B488FC8F9760BC9182C32EF76BE93C
SHA1:	16C3C1C53963CFEDB800515B70E27CA2B7DD79FD
SHA-256:	457E291DC62946AB2DC1CB558FFCA2E90E5EBBD4A27013C5A23930339AEDB978
SHA-512:	30397F8EAF6444502E7E69463463C759711030B0B0CE6812F64F48DEE7BE6D4BA212045544396EF9E603248BB71A5E4A312EB70A6E7B541161A18301003D089C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Windows\System32\SubDir\Client.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\System32\SubDir\Client.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Windows\System32\SubDir\Client.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Windows\System32\SubDir\Client.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Windows\System32\SubDir\Client.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..................1...........1.. ........@.. .......................@2...........@...................................1.S.....2...................... 2...................................................... ............... ..H............text.....1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.081652799630962
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	wUSt04rfJ0.exe
File size:	3'266'048 bytes
MD5:	87b488fc8f9760bc9182c32ef76be93c
SHA1:	16c3c1c53963cfedb800515b70e27ca2b7dd79fd
SHA256:	457e291dc62946ab2dc1cb558ffca2e90e5ebbd4a27013c5a23930339aedb978
SHA512:	30397f8eaf6444502e7e69463463c759711030b0b0ce6812f64f48dee7be6d4ba212045544396ef9e603248bb71a5e4a312eb70a6e7b541161a18301003d089c
SSDEEP:	49152:evQI22SsaNYfdPBldt698dBcjHaLA3qarWboGdmhIOTHHB72eh2NT:evt22SsaNYfdPBldt6+dBcjHN3c
TLSH:	F5E54A1037F85E23E1ABE37395B0041767F1FC2AB3A3EB0B6191677A5C53B5049826A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..................1...........1.. ........@.. .......................@2...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x71e40e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661D0DB4 [Mon Apr 15 11:21:24 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31e3b8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0xa93	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x322000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31c414	0x31c600	9544593358b3f60dafd331263e63c903	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0xa93	0xc00	cdeae95ac72e9e58017d2bcc89d2fbea	False	0.36328125	data	4.653972105845318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x322000	0xc	0x200	280f4c1faf592077116209d063074f64	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3200a0	0x31c	data			0.4484924623115578
RT_MANIFEST	0x3203bc	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text			0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T16:32:03.212960+0100	2027619	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)	1	43.138.147.74	4782	192.168.2.4	49730	TCP
2024-12-24T16:32:03.212960+0100	2035595	ET MALWARE Generic AsyncRAT Style SSL Cert	1	43.138.147.74	4782	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 16:32:01.411128044 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:01.530873060 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:01.534094095 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:01.553088903 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:01.674021959 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:03.089546919 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:03.089616060 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:03.089667082 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:03.093317986 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:03.212960005 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:03.643558979 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:03.691813946 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:06.101125002 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:06.101159096 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:06.101250887 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:06.102658033 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:06.102669001 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:08.498274088 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:08.498362064 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:08.503506899 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:08.503516912 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:08.503917933 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:08.537729025 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:08.583374977 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:09.133833885 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:09.133919001 CET	443	49732	108.181.61.49	192.168.2.4
Dec 24, 2024 16:32:09.133976936 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:09.224647999 CET	49732	443	192.168.2.4	108.181.61.49
Dec 24, 2024 16:32:09.435973883 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:09.555474997 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:09.555708885 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:09.675183058 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:10.267144918 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:10.316818953 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:10.540214062 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:32:10.582716942 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:35.551248074 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:32:35.670787096 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:33:00.676322937 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:33:00.795874119 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:33:25.801363945 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:33:25.921205044 CET	4782	49730	43.138.147.74	192.168.2.4
Dec 24, 2024 16:33:50.926608086 CET	49730	4782	192.168.2.4	43.138.147.74
Dec 24, 2024 16:33:51.046420097 CET	4782	49730	43.138.147.74	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 16:32:05.869268894 CET	56049	53	192.168.2.4	1.1.1.1
Dec 24, 2024 16:32:06.096560001 CET	53	56049	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 16:32:05.869268894 CET	192.168.2.4	1.1.1.1	0x8496	Standard query (0)	ipwho.is	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 16:32:03.862416983 CET	1.1.1.1	192.168.2.4	0x8358	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 16:32:03.862416983 CET	1.1.1.1	192.168.2.4	0x8358	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:03.862416983 CET	1.1.1.1	192.168.2.4	0x8358	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:03.862416983 CET	1.1.1.1	192.168.2.4	0x8358	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:03.862416983 CET	1.1.1.1	192.168.2.4	0x8358	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:06.096560001 CET	1.1.1.1	192.168.2.4	0x8496	No error (0)	ipwho.is		108.181.61.49	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:21.588993073 CET	1.1.1.1	192.168.2.4	0x40e1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 16:32:21.588993073 CET	1.1.1.1	192.168.2.4	0x40e1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:21.588993073 CET	1.1.1.1	192.168.2.4	0x40e1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:21.588993073 CET	1.1.1.1	192.168.2.4	0x40e1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 24, 2024 16:32:21.588993073 CET	1.1.1.1	192.168.2.4	0x40e1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ipwho.is

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	108.181.61.49	443	2180	C:\Windows\System32\SubDir\Client.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 15:32:08 UTC	150	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0 Host: ipwho.is Connection: Keep-Alive
2024-12-24 15:32:09 UTC	223	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 15:32:08 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: ipwhois Access-Control-Allow-Headers: * X-Robots-Tag: noindex
2024-12-24 15:32:09 UTC	1021	IN	Data Raw: 33 66 31 0d 0a 7b 0a 20 20 20 20 22 41 62 6f 75 74 20 55 73 22 3a 20 22 68 74 74 70 73 3a 5c 2f 5c 2f 69 70 77 68 6f 69 73 2e 69 6f 22 2c 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 20 20 22 73 75 63 63 65 73 73 22 3a 20 74 72 75 65 2c 0a 20 20 20 20 22 74 79 70 65 22 3a 20 22 49 50 76 34 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 22 3a 20 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 0a 20 20 20 20 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 20 22 4e 41 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f Data Ascii: 3f1{ "About Us": "https:\/\/ipwhois.io", "ip": "8.46.123.189", "success": true, "type": "IPv4", "continent": "North America", "continent_code": "NA", "country": "United States", "country_code": "US", "region": "New Yo

Target ID:	0
Start time:	10:31:56
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\wUSt04rfJ0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\wUSt04rfJ0.exe"
Imagebase:	0xa20000
File size:	3'266'048 bytes
MD5 hash:	87B488FC8F9760BC9182C32EF76BE93C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1664703539.0000000000D40000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1695273404.000000001BBC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1664340206.0000000000A22000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000002.1692050770.0000000003061000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:31:58
Start date:	24/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1683183819.000002358E630000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1683288087.000002358E8A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1683183819.000002358E638000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1683288087.000002358E8A5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.1682021700.0000006DD9BC9000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:31:58
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:31:58
Start date:	24/12/2024
Path:	C:\Windows\System32\SubDir\Client.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\SubDir\Client.exe"
Imagebase:	0x790000
File size:	3'266'048 bytes
MD5 hash:	87B488FC8F9760BC9182C32EF76BE93C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.2912584091.0000000003040000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.2912584091.0000000002C49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Windows\System32\SubDir\Client.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\System32\SubDir\Client.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Windows\System32\SubDir\Client.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Windows\System32\SubDir\Client.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Windows\System32\SubDir\Client.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	10:31:59
Start date:	24/12/2024
Path:	C:\Windows\System32\SubDir\Client.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SubDir\Client.exe
Imagebase:	0x2b0000
File size:	3'266'048 bytes
MD5 hash:	87B488FC8F9760BC9182C32EF76BE93C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000004.00000002.1718959014.00000000027E9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:32:00
Start date:	24/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1700864870.0000002C9A079000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1701012331.0000014C2ACF0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1700972758.0000014C2ACC0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1701012331.0000014C2ACF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000005.00000002.1700972758.0000014C2ACC5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:32:00
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B7C3525 Relevance: 1.6, APIs: 1, Instructions: 117
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B7C3607

Memory Dump Source

Source File: 00000000.00000002.1696962988.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_wUSt04rfJ0.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0f50ea6cabd9495a2ae4a2f6e9ebeeb6882f6386b79fc482fd757daca46757f1
Instruction ID: 1c132dde2ab6acb22674591dab8d1a544b56a4fce89a963552fda4eedeba4462
Opcode Fuzzy Hash: 0f50ea6cabd9495a2ae4a2f6e9ebeeb6882f6386b79fc482fd757daca46757f1
Instruction Fuzzy Hash: 2F31233190CB5C9FCB19DB688859AF9BBF0EF56310F0542AFC049D72A2CB34A905CB91

Function 00007FFD9B7C3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B7C3607

Memory Dump Source

Source File: 00000000.00000002.1696962988.00007FFD9B7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b7c0000_wUSt04rfJ0.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 0e62c1c24252f1b0bae6f58c35d9e2e9c22cd8e96a88bad6bf3b1941dc0aeb1f
Instruction ID: 14566b77acf5bf7ac191dd0dbd657be449ee36eb32e785e78a50ab0067e30fa6
Opcode Fuzzy Hash: 0e62c1c24252f1b0bae6f58c35d9e2e9c22cd8e96a88bad6bf3b1941dc0aeb1f
Instruction Fuzzy Hash: 9531E03190CB5C8FDB19DB988859AF9BBF0FF66311F05426FC049D32A2CB74A8058B91

Analysis Process: Client.exePID: 2180, Parent PID: 6228COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9BB82321 Relevance: 7.5, Strings: 1, Instructions: 6201COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BB85619

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: 1b9e934eddcf66a3b3fd227d434996bc6944a0037138e2cb2f3ae4243512fce3
Instruction ID: 433c0c1f8809f4e365df84fe41e0cbacc5cf8bb656af4c8b681b40753dde5cc2
Opcode Fuzzy Hash: 1b9e934eddcf66a3b3fd227d434996bc6944a0037138e2cb2f3ae4243512fce3
Instruction Fuzzy Hash: EF83A152B2AE4F0BEBB596AC047527962C2FFD8654B5A417AD40EC33F6ED39ED024340

Function 00007FFD9BA7CAD5 Relevance: 3.9, Strings: 2, Instructions: 1431COMMON

Download Yara Rule

Strings

V/_H, xrefs: 00007FFD9BA7CDD2
W$_L, xrefs: 00007FFD9BA7CD6F

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID: V/_H$W$_L
API String ID: 0-3994505524
Opcode ID: ba1ef3c71864ee1cafb36ad86d6037de3c74134daed4fdd621462ee8a43fb485
Instruction ID: 2c7cdf9645e8364f45bc4a0c7208932cdf6cc15fa133cc69cd7ecce09bba681e
Opcode Fuzzy Hash: ba1ef3c71864ee1cafb36ad86d6037de3c74134daed4fdd621462ee8a43fb485
Instruction Fuzzy Hash: A5A25BB1F1EA8D4FE775DB6884A66A43BD0EF95314B0601FAD08DC71A3EE5C6D068381

Function 00007FFD9BA7B851 Relevance: 2.2, Strings: 1, Instructions: 921
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d$_H, xrefs: 00007FFD9BA7C074

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID: d$_H
API String ID: 0-4016101709
Opcode ID: 352c7269b19f433a3d22b4c604ca107d99adfc062c34608f3118a0632cbb362d
Instruction ID: 6f6684d7b83df44769b3c76878c3cbfefdcf0174c830dfdbf1a469414ab087e7
Opcode Fuzzy Hash: 352c7269b19f433a3d22b4c604ca107d99adfc062c34608f3118a0632cbb362d
Instruction Fuzzy Hash: D3520371B1DE4D4FDBA8EB6884A5AB973D1FF98304F410679D44EC32A6DE64F8428780

Function 00007FFD9BA655D6 Relevance: 2.1, Instructions: 2115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55a66f90c1dd0ffe40f1aa2a747deb008afccf1111347b531d9171f849f8e0a
Instruction ID: 2a418e81c239fb4f383c87b49596c71247bf7786dbb5bab55c99cb2e3916303f
Opcode Fuzzy Hash: a55a66f90c1dd0ffe40f1aa2a747deb008afccf1111347b531d9171f849f8e0a
Instruction Fuzzy Hash: BAF2A270A19A0D8FDFA8DF68C894BA977E1FF98300F1141B9D04ED72A6DA75E941CB40

Function 00007FFD9BA69FD0 Relevance: 1.1, Instructions: 1063COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5095a5be590c31b468e63c06fb8a39cec84e01fdf9f66e708b783e21335b78
Instruction ID: d155d8cccd24bcafdbde5f2ea56007afc84ef6a7c22cafc8ac55e3e4363158cf
Opcode Fuzzy Hash: ed5095a5be590c31b468e63c06fb8a39cec84e01fdf9f66e708b783e21335b78
Instruction Fuzzy Hash: 95624A7171D94D8FEBA8EB2CD465A7837D1EF99300B0601BAE44EC72E6DE64EC428741

Function 00007FFD9BA7EB29 Relevance: 1.0, Instructions: 965COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d109e4e875ad57a199c92eceabeb3b73970a37531f368d7dd00e24e3d5847cc0
Instruction ID: 4ac37e15108fe970cc0d2d1866d76b1822eca356d724339eb886a168bffe00d6
Opcode Fuzzy Hash: d109e4e875ad57a199c92eceabeb3b73970a37531f368d7dd00e24e3d5847cc0
Instruction Fuzzy Hash: F662B131B1CA4E4FDB98DF1888A1AA973E2FF98304F150179E45AC72D6DE35ED428781

Function 00007FFD9BA6AFDD Relevance: .9, Instructions: 862COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b7713775ca799c3ce08d8d6c4f51bcb0b83e9118b757321d266a3773b9650a
Instruction ID: e64196b563e77d127cc27fd7c6672ba5ae0d478f3c173dfb6744fb6f52ed93a8
Opcode Fuzzy Hash: c9b7713775ca799c3ce08d8d6c4f51bcb0b83e9118b757321d266a3773b9650a
Instruction Fuzzy Hash: 74529170B08A498FDBA8EB2CC4A9B6977E1FF99304F5545B9E04DC72A6CE34E841C741

Function 00007FFD9BA69271 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fbd8e1f5a79daabe8af2f62a6e8bf46b3644e19e732ae1f6587e1a17f7d31e9
Instruction ID: 330b61e766720df02003001dda5cf301d7d0c2a8df30fb8e5d22f60aa1b99018
Opcode Fuzzy Hash: 1fbd8e1f5a79daabe8af2f62a6e8bf46b3644e19e732ae1f6587e1a17f7d31e9
Instruction Fuzzy Hash: B322A270B19A0D8FEB68DB6884A57B977E2FF98300F15417DD44EC32A2CE74E9428741

Function 00007FFD9BA6621F Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16525ee20a4aba5f3c783f9d51644792f24a38d1a22d29d13d17d04219f3ffc0
Instruction ID: 074c9e7bd71d03b039a26434910c8c043d920af0fac13e7a98c84db29edf50c7
Opcode Fuzzy Hash: 16525ee20a4aba5f3c783f9d51644792f24a38d1a22d29d13d17d04219f3ffc0
Instruction Fuzzy Hash: 3F027D70E18A1E8FEBA8DF68C4957B977E1FF98300F1541B9D44ED32A5CA74B9818B40

Function 00007FFD9BA77C16 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27271dab1b0ecb156e7e737a9756620b23a867c99525ddf80fb16b60d0052dc
Instruction ID: fa71ed18a000fada079f92625921a2699646e3a46efb9c9cd3d1cc893a10398e
Opcode Fuzzy Hash: b27271dab1b0ecb156e7e737a9756620b23a867c99525ddf80fb16b60d0052dc
Instruction Fuzzy Hash: 00F1A330A0DA8D8FEBA8DF28C895BE937D1FF54314F04426AE85DC7295CB7499458B82

Function 00007FFD9BA78A0F Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616dfa4f45cf33d57ef689d1d9bb9617a2d1520d49ea5221e5c7222121d6b35c
Instruction ID: 004eb5ee1f5fcc0e4c7c728a7b6bdbc965eb2174e6e228fa730c9700a6d9f81b
Opcode Fuzzy Hash: 616dfa4f45cf33d57ef689d1d9bb9617a2d1520d49ea5221e5c7222121d6b35c
Instruction Fuzzy Hash: B6D1A470A0DA4D8FEBA8DF28C8A57E977D1FB94310F00426ED80DC7295DF78A9458B81

Function 00007FFD9BA6E6F9 Relevance: 1.8, APIs: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9BA6E8E6

Memory Dump Source

Source File: 00000003.00000002.2923852030.00007FFD9BA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9ba60000_Client.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: ca3ec434c81b3a6ddeaefe813bb68a7ccb5961ff0807d1b88f9b35b501245509
Instruction ID: 057ac325aeb1735285926c7f9650421572801db1b48f173aed74d4a3c2ac0071
Opcode Fuzzy Hash: ca3ec434c81b3a6ddeaefe813bb68a7ccb5961ff0807d1b88f9b35b501245509
Instruction Fuzzy Hash: 41712671B1DE4D4FDB58EB6C98665F97BE0EF98300B0541BED05EC7293DE28A8428781

Function 00007FFD9B7F3525 Relevance: 1.6, APIs: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B7F3607

Memory Dump Source

Source File: 00000003.00000002.2921429172.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 480abe52860cde742d2574cee4feb05341788f9385c385044f91f9a413102f60
Instruction ID: 0cb1905b8c6b3cecef55421ce666ec286eb3fc94548c4d51d5687683c68ad2c4
Opcode Fuzzy Hash: 480abe52860cde742d2574cee4feb05341788f9385c385044f91f9a413102f60
Instruction Fuzzy Hash: 0131163190CB4C4FDB19DB6888596E97FF0EF56311F0542AFC049D75A2CB34A905C791

Function 00007FFD9B7F3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00007FFD9B7F3607

Memory Dump Source

Source File: 00000003.00000002.2921429172.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: eadc03102c5eff10ed9b4c30124fa279c85142f165fa8b1c015b1f5a85b0f6e2
Instruction ID: e9aeedc9e0e12aff582aa6dcc78d1d29fc2ece21304b3b34b0cad1cfcfd4c983
Opcode Fuzzy Hash: eadc03102c5eff10ed9b4c30124fa279c85142f165fa8b1c015b1f5a85b0f6e2
Instruction Fuzzy Hash: 9631E63190DB5C8FDB19DB6888596E9BBF0FF65311F05426FD049D31A2CB74A805CB91

Function 00007FFD9BB852F1 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

H, xrefs: 00007FFD9BB852F1

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID: H
API String ID: 0-2852464175
Opcode ID: a6713e167a4a6c1dabe6ac152e80ff46ac79b5de55bd38ee9daed69e06c0cf87
Instruction ID: 7540cf425bd50f5d09138274a0ea0fd6b119e82a300af29180abdc15c9e2445a
Opcode Fuzzy Hash: a6713e167a4a6c1dabe6ac152e80ff46ac79b5de55bd38ee9daed69e06c0cf87
Instruction Fuzzy Hash: 4621F812B1EE4E0BF7B6A6AC047527866C2EF98244F5A01BAD40EC73E7DD39ED424344

Function 00007FFD9BB8207D Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87cc0338038c432276747526b8b7084ca700b96ffcb9870ba7b8037d725f638
Instruction ID: 1dc67b6a494d36d8f2a3d5e6e6b0df938c056d7aa316767d69d28de25b751904
Opcode Fuzzy Hash: a87cc0338038c432276747526b8b7084ca700b96ffcb9870ba7b8037d725f638
Instruction Fuzzy Hash: FF81911072AFAA1BE656E7E888B577976D5EF98300F4641B9D10CC36E3CD6CAD024381

Function 00007FFD9BB80000 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b08dc4a553478d43819bca7958aac6bd9eae9a19b2e94a24bd733c68fe50ca9
Instruction ID: c1777e9a50ffbe5c0bd788ce7d9227c03c7641619ab25550f0dda0ecf6f87cb4
Opcode Fuzzy Hash: 8b08dc4a553478d43819bca7958aac6bd9eae9a19b2e94a24bd733c68fe50ca9
Instruction Fuzzy Hash: 6741C32260EACC0FD75697685879A703FE1EF67210B4A01FFD089CB2F3D958AD458351

Function 00007FFD9B6DED65 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2921140301.00007FFD9B6DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b6dd000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbaa3c2dce4440eadcc496cad54139280a305eb49048119cf7010133ee1a087
Instruction ID: db7b3b9d418f18b6ab06b914fe0481bda27bea83654ff73dffe506ef372f6034
Opcode Fuzzy Hash: afbaa3c2dce4440eadcc496cad54139280a305eb49048119cf7010133ee1a087
Instruction Fuzzy Hash: BC41E47150EBC84FE7669B289C559523FF0EF56320B1A06EFD0D8CB1A3D624B846C792

Function 00007FFD9BB8014A Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f72e359c166933e1f68be40033326064f83eac6dd45a4cff599bc5da7704858
Instruction ID: 9b8c3bcb0ce5e8ed6499465acbd98cc7d02dd8ecf79096dfefb6459e8bab8768
Opcode Fuzzy Hash: 3f72e359c166933e1f68be40033326064f83eac6dd45a4cff599bc5da7704858
Instruction Fuzzy Hash: 91315922B1EE890FE769EA5C54767B477C1FBA5724F4501BEE08EC32E2DD14AC428342

Function 00007FFD9BB80676 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e3ec1ef1cf000f154eceaa32370eb22a5355f0b1ac768f701be464d88b5d84
Instruction ID: 3f66eaa68f5d25d1b469c3348342887ed85893468837447c071e2303c099e0a9
Opcode Fuzzy Hash: e6e3ec1ef1cf000f154eceaa32370eb22a5355f0b1ac768f701be464d88b5d84
Instruction Fuzzy Hash: 4B312822B1DE890FE7A89A5C58267B877C1FBA5754F8501BDD08EC32E3DD29AC018342

Function 00007FFD9BB83D9F Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79500c11e613c046f32ef43953c70789841d3269272172d198769e8495f9df3f
Instruction ID: 55ec8f5d2c328b37f819fbfdc1c05b9d11267d153434cd68cc562530551cbc75
Opcode Fuzzy Hash: 79500c11e613c046f32ef43953c70789841d3269272172d198769e8495f9df3f
Instruction Fuzzy Hash: D531B611B1EE4E0BE7B5966C04B557866C2EFD8254B5A01BAE40EC73F6ED29ED024340

Function 00007FFD9BB835BA Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ebf95a4836c212f2d5f5a813ab74d09e5f0a7b3f797c91ec270dad7fc3685f
Instruction ID: 57c3c97c3a437f18b7f64c38fec9d4b9bf9309478d5f53449e2e95e21d2a4a8a
Opcode Fuzzy Hash: 81ebf95a4836c212f2d5f5a813ab74d09e5f0a7b3f797c91ec270dad7fc3685f
Instruction Fuzzy Hash: 0D210B11B1EE4F0BE7A996AC04752B862C2EFD8254B9A017AD40EC33F6ED29ED024340

Function 00007FFD9BB82AAF Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c293847de0fc2b0f70693e8c98ec9247a2d7f9e1c97e226ea27dafc5698cbaa
Instruction ID: 4dbf10067a58531f733e94ce7073c6785547dd7f0513b9dcf8977565bc69ddf8
Opcode Fuzzy Hash: 8c293847de0fc2b0f70693e8c98ec9247a2d7f9e1c97e226ea27dafc5698cbaa
Instruction Fuzzy Hash: 5221DB12B1AE4E0BE7B996AC04B527C62C3FFD8654B5A017AD40EC72F6ED39ED024340

Function 00007FFD9BB83293 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33aa13d88b2f1074cb7baf82e20dd553e0577164d3060dafb3fdf964684b07c
Instruction ID: f2618046841ae3712ad7138d933c2092e04759d07041cdceb2f6c26b2bf7e3d6
Opcode Fuzzy Hash: f33aa13d88b2f1074cb7baf82e20dd553e0577164d3060dafb3fdf964684b07c
Instruction Fuzzy Hash: EF21D711B1AF4F0BE7B5D6AC047527462C2FFD8654B5A41BAD40EC72E6ED39ED024344

Function 00007FFD9BB85090 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3c5915d153cd5ee4d75ffd0923ce9de25f38a753d605b209a1400762f60331
Instruction ID: fef9c7aeb9e8cd444beadd31b0e07f8ff7b30ac66663dfd160d926ed7bfd48e8
Opcode Fuzzy Hash: 5e3c5915d153cd5ee4d75ffd0923ce9de25f38a753d605b209a1400762f60331
Instruction Fuzzy Hash: 1D21A711B1AE4F0FE7B5966C04B467562D2EFD8254B5A01BAD40EC73E6ED39ED024380

Function 00007FFD9BB843EE Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b518f0b8c83e1045405baa6685b98ae3c9731773ed43ece4af0674688739088
Instruction ID: d8186f09506d7ca1b3f9af333059d7c6317c5663adef038f97525f83f5b0a193
Opcode Fuzzy Hash: 2b518f0b8c83e1045405baa6685b98ae3c9731773ed43ece4af0674688739088
Instruction Fuzzy Hash: 3521A712B1AE4F0BF7B9D66C04B5674A6C2EFD8645B5A017AD40EC72E6ED39ED024340

Function 00007FFD9BB8292E Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95d177b7ecce90e9954d3fe23141913f7010d6755fa5e1ece09c88eaadfddf15
Instruction ID: 0364d490d2e84e2adb817089dfbfa685fc64ddc2201fb2358d43d50eb1f117cc
Opcode Fuzzy Hash: 95d177b7ecce90e9954d3fe23141913f7010d6755fa5e1ece09c88eaadfddf15
Instruction Fuzzy Hash: CE21A411B1AE4E0FF7A5A6AC047527866C2EFD8654B5A01BAD40EC33E6ED39ED424384

Function 00007FFD9BB839C2 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49253665b0e5bd1edaeed979821ab64b3a0922fcb99d8583736633a44f6c7f1d
Instruction ID: 7acc4ac87938f6890f8aebb1fc1a0574eeee0f184a7cad4f5f13bd74e2bf8267
Opcode Fuzzy Hash: 49253665b0e5bd1edaeed979821ab64b3a0922fcb99d8583736633a44f6c7f1d
Instruction Fuzzy Hash: 9621D611B1AE4E0BE7B5A6AC147427C66C2EFD8214B5A01BBD40EC32EADD39ED424344

Function 00007FFD9BB8555F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f1d370f136ddc8bf9907470019862fca73dfe611996aba5b1f6b7885e04495
Instruction ID: e16ad52b1e9209a4ecf51aae95bde00d002b5778e4440a5bb3d71768ea6b1322
Opcode Fuzzy Hash: 73f1d370f136ddc8bf9907470019862fca73dfe611996aba5b1f6b7885e04495
Instruction Fuzzy Hash: 4B21D612B1AE4E0FE7B5A66C44A537862C3EFD8214B5A01BAD40EC73E6DD39ED428344

Function 00007FFD9BB83762 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08436211ab5df5b6cb1069b5a7aaa8526f115901e48a862be88df7cdd5025ae5
Instruction ID: ad5343ee84e52ddc43c4e8b63d36d14a1942412af34b1dedd928ae6befef0bae
Opcode Fuzzy Hash: 08436211ab5df5b6cb1069b5a7aaa8526f115901e48a862be88df7cdd5025ae5
Instruction Fuzzy Hash: C4210611B1AE4E0BE7A5E6AC04A467861C2EFD8210B5A01BAD40EC33E6ED39EC024340

Function 00007FFD9BB84E48 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5decbd352e97cebba6c4d2508d71100b86635d3126ee5c30c52e1dfb392a3e8
Instruction ID: 4a0eccc71d1afd2601a3914c7078ce26d435dacca8dd943190223831c4a5cd5b
Opcode Fuzzy Hash: b5decbd352e97cebba6c4d2508d71100b86635d3126ee5c30c52e1dfb392a3e8
Instruction Fuzzy Hash: B321C711B1AE4E0BE7B9E66C04A527862C2EFD8155B5A01BDD40EC33FAED39ED024340

Function 00007FFD9BB826DA Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf247db83382c0e1a7fa33a1c9928a882cb9539613bcb2c01f5970746e6c5689
Instruction ID: 72b332ac9de6deb87923e3d8da1942f243f1de8356e91654887786f7acf4c8d5
Opcode Fuzzy Hash: cf247db83382c0e1a7fa33a1c9928a882cb9539613bcb2c01f5970746e6c5689
Instruction Fuzzy Hash: 50210711B1AF4E0BE3B996AC14B4279A1C3EFC8215F5A01BAD40EC33F6DC29ED024344

Function 00007FFD9BB83CF1 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6959afc4876f27b192fd5f6b1ca02a99b6f315b6f8b9d357782c960949caaf
Instruction ID: eccfae1e4bb444234fd9399f3b2fe77ca5aea62b6280d0e4c9ef4035d171b58b
Opcode Fuzzy Hash: ba6959afc4876f27b192fd5f6b1ca02a99b6f315b6f8b9d357782c960949caaf
Instruction Fuzzy Hash: 0221C811B1AE4E0BE7B6A66C0465278A6C3EFD8214B5A01BAD41EC72F6ED39ED424344

Function 00007FFD9BB8597E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d46f82092c105d92d09ecdc42123978612afe123a2127bf3bb62539e89acc9e
Instruction ID: 8f5b3f82dbded9215863a4729260594c18df33879b7a30efba12464e005d12ed
Opcode Fuzzy Hash: 4d46f82092c105d92d09ecdc42123978612afe123a2127bf3bb62539e89acc9e
Instruction Fuzzy Hash: CB11E61271AE4E0BF7B5A66C0470678A6D2EFC4224B5A01BAD41EC73E6ED39ED424344

Function 00007FFD9BB85330 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ba4861fc55ea32207d5a7a83dfdb5969c5b5e7a644c8134eef6176b82d3944
Instruction ID: 5e39a407bb84019069a007431f80f986f91e58cd19f5bf5c9f01625f6968076f
Opcode Fuzzy Hash: c1ba4861fc55ea32207d5a7a83dfdb5969c5b5e7a644c8134eef6176b82d3944
Instruction Fuzzy Hash: 4D11C81171AE4E0FE7B5D66C1470678A6D2EFD8214F5A01BAD40EC73E6DD39ED024344

Function 00007FFD9BB83B82 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db21829cf62868db552bd2023a48deb5f23dc7994bb577c73a201e0d8daf3feb
Instruction ID: 4112b015ea59f5b37ab45af1af2cd09d0284487e20e1060cad340e0e3e911b73
Opcode Fuzzy Hash: db21829cf62868db552bd2023a48deb5f23dc7994bb577c73a201e0d8daf3feb
Instruction Fuzzy Hash: BD11CB1171EE4F0BF7B6A66C0471678A6C2EFD9614B5A01B9D40EC72F6ED3ADD024344

Function 00007FFD9BB85268 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b0b5e09d96b0edfe41b3f3793176ede717c3ea1e1ee4725dcc06077a6b7d69
Instruction ID: fdfa9fd0fc6263d778b32558c3258e95cbe97df8701dadba45eef9c9f5d69aa7
Opcode Fuzzy Hash: 19b0b5e09d96b0edfe41b3f3793176ede717c3ea1e1ee4725dcc06077a6b7d69
Instruction Fuzzy Hash: 9911AB1171AE4F0BF7B5966C1470678A5D2EFD8214F5A01B9D44EC72E7DD39DD018344

Function 00007FFD9BB80EE1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2924663364.00007FFD9BB80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BB80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9bb80000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7132ee8eef00a2a47b9499304da65b0b0587b90a3f8772fa7fd1dea43b6e66bc
Instruction ID: 7356c2e177ed0d1475a0b54e1b33e30d96c0cdc98b921afe783e038a0e5490f4
Opcode Fuzzy Hash: 7132ee8eef00a2a47b9499304da65b0b0587b90a3f8772fa7fd1dea43b6e66bc
Instruction Fuzzy Hash: 66D0C911B2EA1A4BF22425CC68623F8B285DB88715F511237E409C62E6C8DFAEC242C6

Non-executed Functions

Function 00007FFD9B7FF1F2 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2921429172.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b780eb8136b56c159929a795730053f27b8f772fae26ba66643e95a8e14d24e7
Instruction ID: 1c6c0281cb2fe1283e49c988a192597070140f50e1700fa0c86a3c7bede19fa2
Opcode Fuzzy Hash: b780eb8136b56c159929a795730053f27b8f772fae26ba66643e95a8e14d24e7
Instruction Fuzzy Hash: C131521FF0A1E219E315F2BCB5768ED3B60DF9227E71982F3D19D4D0A79C09108641D9

Analysis Process: Client.exePID: 4208, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B7F0B78 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

;M_I, xrefs: 00007FFD9B7F0C04

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID: ;M_I
API String ID: 0-1276053120
Opcode ID: cb9d68d2aba252ee620b3d04782f37887939ff26cfb7afd7d2084bdc667f1a60
Instruction ID: e4a25238f0823525ec6a408fcdc87c6207d5a92b1025154a295cabf8ce03b1f9
Opcode Fuzzy Hash: cb9d68d2aba252ee620b3d04782f37887939ff26cfb7afd7d2084bdc667f1a60
Instruction Fuzzy Hash: 98A17B22B0FAC54BE3249B7C58755AA7FE1EF85304B9542FBD498473EBDD28A901C381

Function 00007FFD9B7F15FA Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

.M_^, xrefs: 00007FFD9B7F1601

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID: .M_^
API String ID: 0-2820351210
Opcode ID: 747a9978078ed1ccac7da01fe2f52fb743bbbd62d9bff7fe183f6c7e5ed22da0
Instruction ID: 51d5e58b6e6bdf569144e0e611c36c9901932db9e3842cca4da8460930d28796
Opcode Fuzzy Hash: 747a9978078ed1ccac7da01fe2f52fb743bbbd62d9bff7fe183f6c7e5ed22da0
Instruction Fuzzy Hash: 0121F316B0EA9D0FD365AB6C9C751F47BE0EF96221B0E03F7C089C71A3DC0859064394

Function 00007FFD9B7F2188 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b88eac5b14b5a0db66b354208692b16d1cbcdb23bbc69b12ff2015225be9ed
Instruction ID: 8b18c3dbb64776b5955d414829f463e43ebc4398513fde60676e8aecefdf69d6
Opcode Fuzzy Hash: 15b88eac5b14b5a0db66b354208692b16d1cbcdb23bbc69b12ff2015225be9ed
Instruction Fuzzy Hash: 7591F831B19E4E4FEBA4EB688465BB977D2EF94340F4502B5E40DC72F6CD28AD028384

Function 00007FFD9B7F2DE9 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bbb51378bc6f6c2439ce93a787378f68897c05e67a30859f93e70c635eb830a
Instruction ID: 26b65636d940d049fea7ba6f761283d344dde8eaf20f2f1ba635703a5dd921ab
Opcode Fuzzy Hash: 3bbb51378bc6f6c2439ce93a787378f68897c05e67a30859f93e70c635eb830a
Instruction Fuzzy Hash: 9C619861B1990D4FDB98EBA884757FCB7D2EF98310F554279E05ED32E6CE146C428780

Function 00007FFD9B7F2712 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254dd1a769be2fb2021bac3629bb7267ccf82950919f34d61b27884378d660c5
Instruction ID: 88996f30c860e5f97ee2478d3ed2e9a7d7e095b062551d1d0b4e912185c939fd
Opcode Fuzzy Hash: 254dd1a769be2fb2021bac3629bb7267ccf82950919f34d61b27884378d660c5
Instruction Fuzzy Hash: FA415A22B1DA490FEB5897A894666BD7BD0EF95314F41027EF05EC32E2CD286D028796

Function 00007FFD9B7F24E8 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0521590a85157285b466ae8be22470d11b2c02a71e1594dfe87785eae3cbc7
Instruction ID: 31e183499467af02e78c95a8e2d7ff54ad2e47b483d9f5ed276d434252b83a55
Opcode Fuzzy Hash: 6d0521590a85157285b466ae8be22470d11b2c02a71e1594dfe87785eae3cbc7
Instruction Fuzzy Hash: 5B416625B19D1E4FEA94F3AC4071AFF66D3EF89240B9145B4D02DC36EADD2CAD028784

Function 00007FFD9B7F196D Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9203ffc76b708750fc55d526d1737f16222c6e3ba512f8ec1065c4b5c9aa6f
Instruction ID: 1f014d5dbb9f7ffc1aed9ab29263348cb992171c3d9331e84f82cf3ed4282a8c
Opcode Fuzzy Hash: 3a9203ffc76b708750fc55d526d1737f16222c6e3ba512f8ec1065c4b5c9aa6f
Instruction Fuzzy Hash: C3210331B0E6864FDB55DB6880D55A57B91EF51310F1683FAC0588B5BBD928AC86C3C0

Function 00007FFD9B7F1BF5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e19e8221eb6bd7d495dd1f20f143f805b7e7028240e86343a32f34277e1bed2
Instruction ID: cb31a68e186c734c7920e6ddc892eb7d9d03f9ac942c3eadf2e5f3859a4e75f7
Opcode Fuzzy Hash: 7e19e8221eb6bd7d495dd1f20f143f805b7e7028240e86343a32f34277e1bed2
Instruction Fuzzy Hash: AB3194346599858BE308E72C90A5EEB7F61AFC8308F9249E5E828433CACE3C6541CB51

Function 00007FFD9B7F32DD Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a84e6cb7b6e74cf8f78fa9ca9152c322fc9b59ed18d27b85dc0a9f02fc8f89
Instruction ID: b9c5fbdfbdc2e971889e878c5b778d326c0626b67da93da9fd9baf91e05136a6
Opcode Fuzzy Hash: 00a84e6cb7b6e74cf8f78fa9ca9152c322fc9b59ed18d27b85dc0a9f02fc8f89
Instruction Fuzzy Hash: 6221F431F19A5D8FD794EB7888699A977D1EF58301B4205B6E41DC72A6DE34EC00C781

Function 00007FFD9B7F0872 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d7e91a41f8b39524abfcfcdc4aa66908d75fdbef716b3f6d56eac309534d00
Instruction ID: efa2bfabe3690da2de539e4b991687f169bd5932240fb9cc7566302ef375038f
Opcode Fuzzy Hash: f7d7e91a41f8b39524abfcfcdc4aa66908d75fdbef716b3f6d56eac309534d00
Instruction Fuzzy Hash: 8F213592B1EACA4FF355AB644835AA5BFA1FF51740F0506FAD099CB2E7EC08680483D1

Function 00007FFD9B7F3491 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82948fdbb989150d8d007d35b74368b36e09102f4c60ecb88d9d5044757dd690
Instruction ID: ba3fb3168a47940e7900601d95dd6062a0d1908c8ec7fba261debad203394e39
Opcode Fuzzy Hash: 82948fdbb989150d8d007d35b74368b36e09102f4c60ecb88d9d5044757dd690
Instruction Fuzzy Hash: 20117D21B0EB850FE395E6786C698F17FD0DF9422470503BBE44CC31B3CD18A5868391

Function 00007FFD9B7F28D5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396a8372869d3e6d24a05ee1bee0cc4a3461b30504077316cf957504feedd9ce
Instruction ID: 2781bcd954107f2cb66156e1b87b5396acbd94ebed4a636039cb44bfe43b42de
Opcode Fuzzy Hash: 396a8372869d3e6d24a05ee1bee0cc4a3461b30504077316cf957504feedd9ce
Instruction Fuzzy Hash: 5B11C620B0EBCD0FE347E37858A8AA43FD1EF46215B0A41E7E488CB0B7C9584945C342

Function 00007FFD9B7F0DA9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1544288229e365222626551e6e706d10c599cdbedbaa3407ca6b2df5719506
Instruction ID: 927dc0f6571ab0d14fc1ab4feef39e8acd10d175ca31492303ef033813214f2c
Opcode Fuzzy Hash: cd1544288229e365222626551e6e706d10c599cdbedbaa3407ca6b2df5719506
Instruction Fuzzy Hash: 4D014E5371AD8E0EDBA5A62C54A59F67B82DBD5710B0506B6D40DC23B6DD147D4243C0

Function 00007FFD9B7F1E58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438500eb9df471dce427ea4611a325c169b5f8130cddda9fa0823cb93a827a76
Instruction ID: b6ee8f7ec8c951da5c002d9f40693b11a758fce38e8021a804c49389cc8aa791
Opcode Fuzzy Hash: 438500eb9df471dce427ea4611a325c169b5f8130cddda9fa0823cb93a827a76
Instruction Fuzzy Hash: D2F0F022F1981D0FE754F6AD54ECAFA7BD1DBAC22671502B7E40CC72B7DC0498428381

Function 00007FFD9B7F1E70 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33c4f289f0f918d9ca77e1d5369cc6352d16bd8c698e3263572bb0c8931fbce
Instruction ID: 460693d778915d3dc3532e3c8fef514c5ede74a2b54f19813b0bd8c65b91c4a7
Opcode Fuzzy Hash: a33c4f289f0f918d9ca77e1d5369cc6352d16bd8c698e3263572bb0c8931fbce
Instruction Fuzzy Hash: C1E09B21F19C1D1FA794F6AD44DDF7966C1DBAC2117510576E41CC72B6DC149C418381

Function 00007FFD9B7F094D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 264275a600972998d3d8d45f3add922ad5f20d2365c9327ef6caecc6211609c7
Instruction ID: dceda6915c54ad741f89ddeebac1050784350ac23a6cb71f09d814d11a86b593
Opcode Fuzzy Hash: 264275a600972998d3d8d45f3add922ad5f20d2365c9327ef6caecc6211609c7
Instruction Fuzzy Hash: E7E02622F1A91A57E394337820364FC2581CF48690B41053AE40DC62EBEC1D6D420284

Function 00007FFD9B7F2DC8 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1723885405.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7f0000_Client.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb34cfd6402c0cf2cd3d1552bc79771280b33ffe8363ad7088facd0752a6bcfc
Instruction ID: 4f5a2ac70440ddbf5dd8d05bae4b54741cff1a685b8801eb762a0e07459db911
Opcode Fuzzy Hash: eb34cfd6402c0cf2cd3d1552bc79771280b33ffe8363ad7088facd0752a6bcfc
Instruction Fuzzy Hash: 99C01262B16E4E4BDB65EFC824912F87691FFC83807D50239A008E2175CF241551A284

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wUSt04rfJ0.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wUSt04rfJ0.exe.log

C:\Windows\System32\SubDir\Client.exe

Static File Info

General

File Icon

Windows Analysis Report
wUSt04rfJ0.exe

Function 00007FFD9B7C3525 Relevance: 1.6, APIs: 1, Instructions: 117
fileCOMMON

Function 00007FFD9B7C3569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Function 00007FFD9BA7B851 Relevance: 2.2, Strings: 1, Instructions: 921
COMMON

Function 00007FFD9BA6E6F9 Relevance: 1.8, APIs: 1, Instructions: 272
COMMON