Signed QuaTouchCtrl Loader Uses Mutual TLS to Reach Its Command Server

Summary

Analysis identifies QuaTouchCtrl.exe as a signed loader with encrypted strings and an embedded client certificate for mutual TLS. It can run server-provided modules in memory; the observed server replied with no jobs.

Key points

QuaTouchCtrl.exe disguises itself as a Quartz touch-controller utility and carries a valid EV signature attributed to AirTiki ApS, which the article says is unrelated to the claimed product.
The loader decrypts 88 strings with ChaCha20, including its configuration, server details, and embedded client certificate and private key.
It uses a client certificate issued by private CA ca-arch for mutual TLS; the malware disables validation of the server certificate.
The loader checks in to gitihubusercomtent[.]com at 178[.]105[.]122[.]30 and can run server-provided modules in memory without writing them to disk.
In a sandbox capture, the live server accepted the client certificate and replied with a 60-second interval and no jobs; the researchers did not retrieve the unavailable modules.
The article reports testing job handling against a researcher-controlled fake server using junk payloads, so no real modules were loaded during those tests.
The analysis recommends hunting for the ca-arch and srv-arch.internal certificate identifiers, the listed domain and IP, and an unusual WinHTTP user-agent string.

Article Details

Attack Vectors: QuaTouchCtrl.exe disguises itself as the signed “Quartz Touch Controller” driver helper from “Quartz Devices”; the article does not establish how it reaches victims.
The loader checks in with its C2 server over HTTPS using a built-in client certificate for mutual TLS.
The loader can download server-assigned programs and map and run them from memory without writing them to disk.
Its strings are encrypted with ChaCha20 and decrypted at startup.
Defensive Notes: Block and hunt for gitihubusercomtent[.]com and 178[.]105[.]122[.]30.
Look for TLS servers presenting CN=srv-arch.internal with issuer CN=ca-arch; the article identifies these certificates as fingerprints of the operation.
Investigate unusual WinHTTP traffic using the truncated user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36.
On suspect hosts, investigate an unfamiliar driver process that created an orphaned crypto key container under %APPDATA%\Microsoft\Crypto\RSA\<SID>\.
Do not treat a valid code-signing signature as proof that a program is safe; obtain drivers and device utilities from the PC or device maker.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`gitihubusercomtent[.]com`	C2 domain contacted by the loader.
IPV4	`178[.]105[.]122[.]30`	IP address of the loader's C2 server.
SHA256	`a967b46481f77ce9bdd6e57afe858943dd5c03e8810a95e3223c9b2ccec06ec6`	SHA-256 hash of the QuaTouchCtrl.exe loader.
SHA256	`bfe114ef9835d9d0ac996a19f25d2ae4c4d4e7d50185bd72e82d48ccea9db893`	SHA-256 fingerprint of the client certificate embedded in the loader and used for mutual TLS.
SHA256	`ef54a9c2cab7fbcc2cca17dd1e5ca6dc207b06e80bd44f44689af7bb3527de39`	SHA-256 fingerprint of the C2 server certificate.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe loader encrypts all 88 text strings with ChaCha20 and decrypts them at runtime.T1036 · MasqueradingThe loader presents itself as a signed “Quartz Touch Controller” driver helper from “Quartz Devices.”T1069.001 · Local GroupsThe loader reports whether it is running as an administrator, as SYSTEM, or as a member of the Administrators group.T1071.001 · Web ProtocolsThe loader checks in to its C2 server using HTTPS POST requests and JSON messages.T1082 · System Information DiscoveryThe check-in includes a machine fingerprint derived from the Windows machine GUID, computer name, and C: drive serial number.T1105 · Ingress Tool TransferThe loader can download the server-assigned module and checker programs.T1140 · Deobfuscate/Decode Files or InformationAt startup, the loader decrypts its embedded strings, including its server details and message templates.T1573 · Encrypted ChannelThe loader communicates with its C2 server over TLS using a built-in client certificate for mutual TLS.T1620 · Reflective Code LoadingThe loader manually maps downloaded programs into memory and runs them without writing them to disk.

Malware

QuaTouchCtrl.exeQuaTouchCtrl.exe calls itself the "Quartz Touch Controller" from "Quartz Devices", a driver helper that "processes touch controller interrupts".

Products

Microsoft WindowsCode signing is a digital seal that tells Windows which company published a program and that nobody has changed it since.Quartz Touch ControllerQuaTouchCtrl.exe calls itself the "Quartz Touch Controller" from "Quartz Devices", a driver helper that "processes touch controller interrupts".

Tools