Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
03-11-2021 19:15
Static task
static1
General
-
Target
70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe
-
Size
14KB
-
MD5
9860743c4ff83784de05aa8444594aed
-
SHA1
517ab424f9f6ee8de223e396691f1cb3b2d01a09
-
SHA256
70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35
-
SHA512
cae8c9f056f7556d30e170caca7b4146baf00eaa32b6d2fac8659d2547d97e1461ee8cce0b123db02d5497faf9e12057d5daa530b4b8e722d73c66e769064b88
Malware Config
Extracted
quasar
1.4.0
helper
41.79.11.214:61032
307d89ac-968f-48de-a3b3-0c81d2cf4d4a
-
encryption_key
0D0F7891BD61AE0C503175723ADA783C9973F3B8
-
install_name
DllHelper.exe
-
log_directory
Logs
-
reconnect_delay
5000
-
startup_key
DllHelper
-
subdirectory
DllHelper
Signatures
-
Quasar Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exe family_quasar C:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exe family_quasar C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exe family_quasar C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exe family_quasar -
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
cbrqjjtd.exeDllHelper.exepid process 1232 cbrqjjtd.exe 4052 DllHelper.exe -
Drops startup file 2 IoCs
Processes:
70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmic.exe 70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wmic.exe 70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 api.ipify.org 26 api.ipify.org -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cbrqjjtd.exeDllHelper.exedescription pid process Token: SeDebugPrivilege 1232 cbrqjjtd.exe Token: SeDebugPrivilege 4052 DllHelper.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
DllHelper.exepid process 4052 DllHelper.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.execbrqjjtd.exeDllHelper.exedescription pid process target process PID 3388 wrote to memory of 1232 3388 70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe cbrqjjtd.exe PID 3388 wrote to memory of 1232 3388 70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe cbrqjjtd.exe PID 1232 wrote to memory of 624 1232 cbrqjjtd.exe schtasks.exe PID 1232 wrote to memory of 624 1232 cbrqjjtd.exe schtasks.exe PID 1232 wrote to memory of 4052 1232 cbrqjjtd.exe DllHelper.exe PID 1232 wrote to memory of 4052 1232 cbrqjjtd.exe DllHelper.exe PID 4052 wrote to memory of 1780 4052 DllHelper.exe schtasks.exe PID 4052 wrote to memory of 1780 4052 DllHelper.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe"C:\Users\Admin\AppData\Local\Temp\70da41b661dc8de4e8cd1bde0f17f434433115bffad2fb762205b734acd4ed35.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exeC:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DllHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exe"C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "DllHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exeMD5
0b1906293450341a4fc2d4cd2d4f1b48
SHA10f9a4604fb09b2262c8a99653e856ed71dbdc054
SHA2563c70bee98b3b7ec593a986787ad60f4ad8c1161e48986d3ed254886fbadc55d5
SHA512cd21a212f6f2c31b4b0fb42a1c739376ccbe607e2af639635b1889f37e8a7e916c6e197aa33cc15a62ddc33bd2091462f98ea1c4e9a3af77a759b9cff1ac6aca
-
C:\Users\Admin\AppData\Local\Temp\cbrqjjtd.exeMD5
0b1906293450341a4fc2d4cd2d4f1b48
SHA10f9a4604fb09b2262c8a99653e856ed71dbdc054
SHA2563c70bee98b3b7ec593a986787ad60f4ad8c1161e48986d3ed254886fbadc55d5
SHA512cd21a212f6f2c31b4b0fb42a1c739376ccbe607e2af639635b1889f37e8a7e916c6e197aa33cc15a62ddc33bd2091462f98ea1c4e9a3af77a759b9cff1ac6aca
-
C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exeMD5
0b1906293450341a4fc2d4cd2d4f1b48
SHA10f9a4604fb09b2262c8a99653e856ed71dbdc054
SHA2563c70bee98b3b7ec593a986787ad60f4ad8c1161e48986d3ed254886fbadc55d5
SHA512cd21a212f6f2c31b4b0fb42a1c739376ccbe607e2af639635b1889f37e8a7e916c6e197aa33cc15a62ddc33bd2091462f98ea1c4e9a3af77a759b9cff1ac6aca
-
C:\Users\Admin\AppData\Roaming\DllHelper\DllHelper.exeMD5
0b1906293450341a4fc2d4cd2d4f1b48
SHA10f9a4604fb09b2262c8a99653e856ed71dbdc054
SHA2563c70bee98b3b7ec593a986787ad60f4ad8c1161e48986d3ed254886fbadc55d5
SHA512cd21a212f6f2c31b4b0fb42a1c739376ccbe607e2af639635b1889f37e8a7e916c6e197aa33cc15a62ddc33bd2091462f98ea1c4e9a3af77a759b9cff1ac6aca
-
memory/624-121-0x0000000000000000-mapping.dmp
-
memory/1232-118-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1232-120-0x000000001B6B0000-0x000000001B6B2000-memory.dmpFilesize
8KB
-
memory/1232-115-0x0000000000000000-mapping.dmp
-
memory/1780-128-0x0000000000000000-mapping.dmp
-
memory/4052-122-0x0000000000000000-mapping.dmp
-
memory/4052-127-0x0000000001300000-0x0000000001302000-memory.dmpFilesize
8KB
-
memory/4052-129-0x000000001B750000-0x000000001B751000-memory.dmpFilesize
4KB
-
memory/4052-130-0x000000001D750000-0x000000001D751000-memory.dmpFilesize
4KB