Find similar analyses in TI Lookup

Analysis date (UTC): 17 January 2023, 20:16Analysis environment: Windows 7 Pro, build 7601, x86

ss.ps1

MD5:970ACA768E68FAA580F758A1A379686B

SHA1:6A93921485CBD83382EB5A47315B1F0A67BCF684

SHA256:6C1E62385D660CA43E024D461154FBB4805E429CDF7850D19510D7F69533739E

Analysis result

Threat level:Malicious activity

Tags:

trojanratquasarasyncrat

Full analysis:Analysis ss.ps1 (MD5: 970ACA768E68FAA580F758A1A379686B) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

RegAsm.exe (PID: 2404)

QUASAR was detected

RegAsm.exe (PID: 2404)

Connects to the CnC server

RegAsm.exe (PID: 2404)

ASYNCRAT was detected

RegAsm.exe (PID: 2404)

ASYNCRAT detected by memory dumps

RegAsm.exe (PID: 2404)

Unusual connection from system programs

RegAsm.exe (PID: 2404)

QUASAR detected by memory dumps

RegAsm.exe (PID: 2404)

SUSPICIOUS

Reads the Internet Settings

powershell.exe (PID: 1772)

Reads settings of System Certificates

RegAsm.exe (PID: 2404)

Connects to unusual port

RegAsm.exe (PID: 2404)

INFO

Reads the computer name

RegAsm.exe (PID: 2404)

Reads security settings of Internet Explorer

powershell.exe (PID: 1772)

The process checks LSA protection

powershell.exe (PID: 1772)
RegAsm.exe (PID: 2404)

Checks supported languages

RegAsm.exe (PID: 2404)

Reads Environment values

RegAsm.exe (PID: 2404)

Reads the machine GUID from the registry

RegAsm.exe (PID: 2404)

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2404	RegAsm.exe	A Network Trojan was detected	ET TROJAN Observed Malicious SSL Cert (Quasar CnC)
2404	RegAsm.exe	A Network Trojan was detected	ET TROJAN Generic AsyncRAT Style SSL Cert