Windows Analysis Report
fP4kybhBWi.exe

Overview

General Information

Sample name: fP4kybhBWi.exe
renamed because original name is a hash value
Original sample name: 24e7acb706dffb37b3e682424719f5ab.exe
Analysis ID: 1429034
MD5: 24e7acb706dffb37b3e682424719f5ab
SHA1: 5d4864f3acb3076ee4005990114a4a1f2520d456
SHA256: 0972bb0ba1caff7adc92bb35f645b5e0d825fa74fb1b76ff822dce8c200ab30d
Tags: exeQuasarRATRAT
Infos:

Detection

Quasar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Quasar RAT
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for sample
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Quasar RAT, QuasarRAT Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
  • APT33
  • Dropping Elephant
  • Stone Panda
  • The Gorgon Group
 https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: fP4kybhBWi.exe Avira: detected
Found malware configuration
Source: fP4kybhBWi.exe Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "Kneegrowless-33547.portmap.host:33547;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "10674f25-f575-4b14-92cf-06a7073df875", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "ji28SC/Z7kdpMR++uBll5VeMqi5a2WV72FOMIv6ozXCA189OyXcUUW5gjmgW1XEt3xSZdLSQf7Isp0EMqDpvCd37jvvOLv0+/uecz3+2ho7XZQ35pDT8f+NnuCMBBsuL4PZMOP4LoSOS8oXdF7+xxPcisn4x7miA7CfcqN7Y7dy0/CCXledFpGVvtvZiUR5huQqJvgRcU+EqqMHJCtwdsXql06Cv0KJeW6MNkDFGvIdxzJkShPWsNRjYF2JqJPgnQwyLSQHuq9l7jzppwbT0Zq0tn6c+Hv5Wmr7yzUe6SPrOvTtGJ+JYviKCxMq2CgjgDj0ZvCOUbqlQTRYdOhbBwfPUAPwhJItFr8xwqfeTUjLMDz/bPm53yhYMW6SId/tdp8GYE3qZfXFP6Dl5aY3vxlr3yeO6yc3O8pnq3UWns1LI1GDGdoErhmQCSvnX6zfzq1862B/7LeCm0zftW2IWx/wrA4boL1K2R7L7PmrRoiJQ7SSGT639PY1PxFWVY18h41IZoYA7+QYya5ZNoA5uH05ubNC/SnfB1HBHlM8tAV1FoAmsjOEEUYl1AYRH+rRlPFFJj4TIU9s/v6HeGwIYPs4bC3X1+rLXJ5zgBl/knU+k2udfd9zDufqi/UmRiaw/phmdTdvBHfzr8BXwRydRCeykfnjInLjNHMxYizlhcAA=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAObc2PsO8t+C9RP68pkf9zANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDQxNTAwMzUxMFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4iD0nkAjxSvNVNQpzdFlbEc/OL+AG8iQhKo6+KhVR+bexodEoH7GuQtgCgM/EfCZvZb/+ZUL5nIgLxQcZXM00M7SaZOZkX77iUgFNM8RUWhqK9Dpwet4r/SI769/faosm2EtCap6NHJVnsL0Ce9jKG62TrBRcPhv4GCP34n5dnb6BbLAunKp9IohBWHqbDqFv8ZD4xJVg2ZZjKm7ChVZxNrHGzgzsOll44zIasWifPimmdqr96BtudFPFy/KnXJtqxBiJWytWr/4dy/E5DZgPBe1m0QgKrZYznvBotzixP1RRLVg/kPAdulgzIWtCA3mF6kWBKlhENE+V95YVCM/qA0V7kd/s72eQ+I1mscxu3OcbGx411cxYefVPJ6sKKLS4WcFcLzjghMNC+TWsvVRLLDJ77NT31MmhyX0GO4zp26KLqqNzvyNC97chOLFBNZbovpmCUI/Nr2rxkIRSR/EjSLlTx7FMwyL5CyMsy7l8zQf6o8y6Vz6yx3R6NjmOuAuWzi89Rju2lmsXp+j+ttGbDf6l5NtmB/yFubJpjCybk7ibhbY418K4r+DJWMpiKvLrb4HPc9aonrnZ84yvUxvDspKd8GD2tAwAqnCvllIhvsHD7nGMmXgwccXMSZhd25AxX8m/p3TPme+vweRdI0nEDJ7Zm/qSVygzEI6cK5z8ckCAwEAAaMyMDAwHQYDVR0OBBYEFKVPFAajyQZEQP127X7TDcCxL32hMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBADcztBaCtWlRw8QrTl9e3K58QJw3IqFUqevnIhSIaNhwScsPronoGc8YfDQAntjCU6Sl9O00tP5KqkJ5qh3Y4L/97bS2lChd0QihNN8fCyfdWQk5k85Oglh2WnWqXGvSyMB/4sDd3wBF3yvigXFId7OlIbKzKSoQusvvNja9yL5a0v1A8eIY6cXWx+7uJOiPm4tkRQU+KhexK0v/DYeM3h3y40SBoOV2MVyV/4Vh/+AIGsmANwrg5ziyIf7VHbT229V38bPcwGs/WLN7txbebJRklgfGCPj1NTagQG2Lbc7fkAQHNBZvWR9t0GacbCEdpU/8kDMSoWjWaQKXO2yrijr9fiEmht6ml2MZ/wlBI57Z7Rp+TTCcwNBXZuo3fHxhO+NOr/nPa7TaM9weOel0CPLSOiNBoMvh0laNAKO/0hIiCxagFzCCks5COGWw0HeVjtqb8lyE0HdaKemmr+mH2vkFoVcVKsxua4V8/m1p34lDYSBYdjpO2BXvz/Sr2R0GvlKXEjRX50JVNFVc4NjtCUiSLcPCzb59JxjqLfjLDbtOpS6jjh726GKSoFzK7dVnULNIPN2C3DkbqDZLFm+ql0sx72LsniSpFF8v2IVGSrGWXNV3u0yWtxhoYojCV6pttA4TFWKQIljMzCsBU1urmN6OwC7xPh7UE3QN3CyODZyY"}
Multi AV Scanner detection for submitted file
Source: fP4kybhBWi.exe ReversingLabs: Detection: 76%
Source: fP4kybhBWi.exe Virustotal: Detection: 76% Perma Link
Yara detected Quasar RAT
Source: Yara match File source: fP4kybhBWi.exe, type: SAMPLE
Source: Yara match File source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1664469074.0000000000440000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002963000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1664117031.0000000000122000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fP4kybhBWi.exe PID: 7156, type: MEMORYSTR
Machine Learning detection for sample
Source: fP4kybhBWi.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: fP4kybhBWi.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 15.204.213.5:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: fP4kybhBWi.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 193.161.193.99:33547 -> 192.168.2.4:49730
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: Kneegrowless-33547.portmap.host
Yara detected Generic Downloader
Source: Yara match File source: fP4kybhBWi.exe, type: SAMPLE
Source: Yara match File source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49730 -> 193.161.193.99:33547
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 193.161.193.99 193.161.193.99
Source: Joe Sandbox View IP Address: 15.204.213.5 15.204.213.5
Source: Joe Sandbox View IP Address: 15.204.213.5 15.204.213.5
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BITREE-ASRU BITREE-ASRU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: Kneegrowless-33547.portmap.host
Source: fP4kybhBWi.exe, 00000000.00000002.2922518377.000000001B4DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: fP4kybhBWi.exe, 00000000.00000002.2922518377.000000001B4DE000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: fP4kybhBWi.exe, 00000000.00000002.2920268562.0000000002914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ipwho.is
Source: fP4kybhBWi.exe, 00000000.00000002.2920268562.0000000002914000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ipwho.is0v
Source: fP4kybhBWi.exe, 00000000.00000002.2920268562.0000000002963000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: fP4kybhBWi.exe, 00000000.00000002.2920268562.0000000002791000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: fP4kybhBWi.exe String found in binary or memory: https://api.ipify.org/
Source: fP4kybhBWi.exe, 00000000.00000002.2920268562.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ipwho.is
Source: fP4kybhBWi.exe String found in binary or memory: https://ipwho.is/
Source: fP4kybhBWi.exe String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: fP4kybhBWi.exe String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: fP4kybhBWi.exe String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown HTTPS traffic detected: 15.204.213.5:443 -> 192.168.2.4:49732 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Quasar RAT
Source: Yara match File source: fP4kybhBWi.exe, type: SAMPLE
Source: Yara match File source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1664469074.0000000000440000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002963000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1664117031.0000000000122000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fP4kybhBWi.exe PID: 7156, type: MEMORYSTR

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: fP4kybhBWi.exe, type: SAMPLE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: fP4kybhBWi.exe, type: SAMPLE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: fP4kybhBWi.exe, type: SAMPLE Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar infostealer Author: ditekshen
Detected potential crypto function
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD45BE1 0_2_00007FFD9BD45BE1
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD4BA95 0_2_00007FFD9BD4BA95
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD48A61 0_2_00007FFD9BD48A61
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD56A26 0_2_00007FFD9BD56A26
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD5B0C1 0_2_00007FFD9BD5B0C1
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD5B7F8 0_2_00007FFD9BD5B7F8
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD497C0 0_2_00007FFD9BD497C0
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD577D2 0_2_00007FFD9BD577D2
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD4A7CD 0_2_00007FFD9BD4A7CD
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD5A5F9 0_2_00007FFD9BD5A5F9
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD44DC6 0_2_00007FFD9BD44DC6
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD5EC90 0_2_00007FFD9BD5EC90
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD410FA 0_2_00007FFD9BD410FA
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD410D1 0_2_00007FFD9BD410D1
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BE12391 0_2_00007FFD9BE12391
Sample file is different than original file name gathered from version info
Source: fP4kybhBWi.exe, 00000000.00000000.1664469074.0000000000440000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameClient.exe. vs fP4kybhBWi.exe
Source: fP4kybhBWi.exe Binary or memory string: OriginalFilenameClient.exe. vs fP4kybhBWi.exe
Uses 32bit PE files
Source: fP4kybhBWi.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: fP4kybhBWi.exe, type: SAMPLE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: fP4kybhBWi.exe, type: SAMPLE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: fP4kybhBWi.exe, type: SAMPLE Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: classification engine Classification label: mal100.troj.evad.winEXE@1/2@2/2
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Mutant created: NULL
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\10674f25-f575-4b14-92cf-06a7073df875
Source: fP4kybhBWi.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fP4kybhBWi.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\fP4kybhBWi.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: fP4kybhBWi.exe ReversingLabs: Detection: 76%
Source: fP4kybhBWi.exe Virustotal: Detection: 76%
Source: fP4kybhBWi.exe String found in binary or memory: HasSubValue3Conflicting item/add type
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Section loaded: userenv.dll Jump to behavior
Source: fP4kybhBWi.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: fP4kybhBWi.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: fP4kybhBWi.exe Static file information: File size 3266048 > 1048576
Source: fP4kybhBWi.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c600
Source: fP4kybhBWi.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9B9BD2A5 pushad ; iretd 0_2_00007FFD9B9BD2A6
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9B9BF755 pushfd ; ret 0_2_00007FFD9B9BF757
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BADC9DF pushfd ; ret 0_2_00007FFD9BADC9E2
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BADB914 push esi; ret 0_2_00007FFD9BADB94A
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BADB904 push ebx; ret 0_2_00007FFD9BADB912
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BADB8FA push edx; ret 0_2_00007FFD9BADB902
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BAD7923 push ebx; retf 0_2_00007FFD9BAD796A
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BADAC9C push es; ret 0_2_00007FFD9BADACCA
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BADB885 push edx; ret 0_2_00007FFD9BADB8EA
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BAD74CB push ebx; iretd 0_2_00007FFD9BAD756A
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD42C10 push eax; ret 0_2_00007FFD9BD42BFC
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD42B90 push eax; ret 0_2_00007FFD9BD42BFC
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD622F0 push esp; iretd 0_2_00007FFD9BD622F1
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BD66DB1 push ebx; retf 0_2_00007FFD9BD6796A
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BE11452 push cs; ret 0_2_00007FFD9BE11453
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BE115D8 push ss; ret 0_2_00007FFD9BE115D9
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BE1179F push ds; ret 0_2_00007FFD9BE117A0
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Code function: 0_2_00007FFD9BE1130D push es; ret 0_2_00007FFD9BE1130E

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe File opened: C:\Users\user\Desktop\fP4kybhBWi.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Memory allocated: C80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Memory allocated: 1A790000 memory reserve | memory write watch Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Window / User API: threadDelayed 808 Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Window / User API: threadDelayed 473 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\fP4kybhBWi.exe TID: 6300 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\fP4kybhBWi.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\fP4kybhBWi.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: fP4kybhBWi.exe, 00000000.00000002.2922518377.000000001B512000.00000004.00000020.00020000.00000000.sdmp, fP4kybhBWi.exe, 00000000.00000002.2922518377.000000001B4DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: fP4kybhBWi.exe, 00000000.00000002.2922518377.000000001B3B2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%j
Enables debug privileges
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Queries volume information: C:\Users\user\Desktop\fP4kybhBWi.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\fP4kybhBWi.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Quasar RAT
Source: Yara match File source: fP4kybhBWi.exe, type: SAMPLE
Source: Yara match File source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1664469074.0000000000440000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002963000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1664117031.0000000000122000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fP4kybhBWi.exe PID: 7156, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Quasar RAT
Source: Yara match File source: fP4kybhBWi.exe, type: SAMPLE
Source: Yara match File source: 0.0.fP4kybhBWi.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.1664469074.0000000000440000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002963000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2920268562.0000000002791000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1664117031.0000000000122000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fP4kybhBWi.exe PID: 7156, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1429034 Sample: fP4kybhBWi.exe Startdate: 20/04/2024 Architecture: WINDOWS Score: 100 10 Kneegrowless-33547.portmap.host 2->10 12 ipwho.is 2->12 14 bg.microsoft.map.fastly.net 2->14 20 Snort IDS alert for network traffic 2->20 22 Found malware configuration 2->22 24 Malicious sample detected (through community Yara rule) 2->24 26 6 other signatures 2->26 6 fP4kybhBWi.exe 14 2 2->6         started        signatures3 process4 dnsIp5 16 Kneegrowless-33547.portmap.host 193.161.193.99, 33547, 49730 BITREE-ASRU Russian Federation 6->16 18 ipwho.is 15.204.213.5, 443, 49732 HP-INTERNET-ASUS United States 6->18 28 Hides that the sample has been downloaded from the Internet (zone.identifier) 6->28 signatures6
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
193.161.193.99
 Kneegrowless-33547.portmap.host Russian Federation
198134 BITREE-ASRU true
15.204.213.5
 ipwho.is United States
71 HP-INTERNET-ASUS false

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true
ipwho.is 15.204.213.5 true
Kneegrowless-33547.portmap.host 193.161.193.99 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ipwho.is/ false
  • URL Reputation: safe
 unknown
Kneegrowless-33547.portmap.host true unknown