Analysis date (UTC): 18 October 2023, 03:30Analysis environment: Windows 7 Pro, build 7601, x86

Dokkaebi.exe

MD5:4FAA9CDDBC2D18B55D515B4A27AC6B89

SHA1:3C74B66344F04C44017E114C7323B63AF13B4C69

SHA256:6CF1314C130A41C977AAFCE4585A144762D3FB65F8FE493E836796B989B002CB

Analysis result

Threat level:Malicious activity

Tags:

ratquasarremoteasyncrat

Full analysis:Analysis Dokkaebi.exe (MD5: 4FAA9CDDBC2D18B55D515B4A27AC6B89) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Dokkaebi.exe (PID: 4068)

Application was dropped or rewritten from another process

Client.exe (PID: 2748)
Dokkaebi.exe (PID: 4068)

ASYNCRAT was detected

Client.exe (PID: 2748)

Connects to the CnC server

Client.exe (PID: 2748)

QUASAR was detected

Client.exe (PID: 2748)

QUASAR has been detected (YARA)

Client.exe (PID: 2748)

SUSPICIOUS

Starts itself from another location

Dokkaebi.exe (PID: 4068)

Reads settings of System Certificates

Client.exe (PID: 2748)

Reads the Internet Settings

Client.exe (PID: 2748)

Connects to unusual port

Client.exe (PID: 2748)

INFO

Reads the computer name

wmpnscfg.exe (PID: 1192)
Dokkaebi.exe (PID: 4068)
Client.exe (PID: 2748)

Checks supported languages

wmpnscfg.exe (PID: 1192)
Dokkaebi.exe (PID: 4068)
Client.exe (PID: 2748)

Reads the machine GUID from the registry

wmpnscfg.exe (PID: 1192)
Dokkaebi.exe (PID: 4068)
Client.exe (PID: 2748)

Reads Environment values

Dokkaebi.exe (PID: 4068)
Client.exe (PID: 2748)

Creates files or folders in the user directory

Dokkaebi.exe (PID: 4068)

Create files in a temporary directory

Client.exe (PID: 2748)

Manual execution by a user

explorer.exe (PID: 1868)

Threats

PID	Process	Class	Message
1088	svchost.exe	Potentially Bad Traffic	ET INFO playit .gg Tunneling Domain in DNS Lookup
2748	Client.exe	Domain Observed Used for C2 Detected	ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
2748	Client.exe	Domain Observed Used for C2 Detected	ET MALWARE Generic AsyncRAT Style SSL Cert
1088	svchost.exe	Potentially Bad Traffic	ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
1088	svchost.exe	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2748	Client.exe	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2748	Client.exe	Malware Command and Control Activity Detected	REMOTE [ANY.RUN] QuasarRAT Successful Connection (CBC_SHA384)