Managed XDR

bd6c9008-5296-f2ae-ffc6-3ed9af0c9b02.eml (QuasarRat) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
bd6c9008-5296-f2ae-ffc6-3ed9af0c9b02.eml
Тип файла
RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
Размер файла
1015.3 KB
Первое обнаружение
Последнее обнаружение

Окружение

w10/x64 en

Хеши

SHA1
70aa10cf9c57b5f9dc8be152c8efaa1d55a2014e
SHA256
2725412e921eaf14dfd1f2add2026a4ee921b8f7503e9f307072da41b750d271
MD5
96885f3a571b5158606ff9c53bd9a93a

Вредоносное ПО

  • QuasarRat

Сигнатуры

Execution

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup

Privilege Escalation

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1564.001 hides_original_file: Makes original executable file hidden
T1564.001 stealth_file: Creates hidden or system files
T1564.004 removes_zoneid_ads: Attempts to hide the indications that the file was downloaded from the Internet
T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.001 antivm_network_adapters: Checks NIC addresses
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497 antidbg_query_process: Checks if the process is being debugged (ProcessDebugPort)
T1497.001 antivm_network_adapters: Checks NIC addresses
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1057 has_wmi: Executes one or several WMI requests

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
networkdyndns_checkip: Connects to a Dynamic DNS domain
unpacker_wrong_base: Possibly, an error occurred in the file unpacker
copies_self: Creates a copy of itself
ip_domains: Identifies an IP address using external resources
network_bind: Starts servers listening at None
creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
executes_dropped_exe: Executes dropped exe files
process_crashed: One of the processes has failed
create_rpc_bindings: Creates RPC connection
require_administrator: Requests administrator privileges
creates_suspended_process: Creates suspended process
dotnet_antimetadata_analysis: Dotnet program has anti-analysis tricks
dotnet_import_unmanaged_code: Dotnet program statically imports unmanaged functions/modules
break_limit_exceeded: Warning: function calls limit has been exceeded
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
dotnet_use_suspicious_functions: Dotnet program potentially uses suspicious functions/modules

Похожие отчёты

Managed XDR