Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-12-2021 18:50
Behavioral task
behavioral1
Sample
7411c8d36761ca9edc88373cfc7a3cb7.exe
Resource
win7-en-20211208
General
-
Target
7411c8d36761ca9edc88373cfc7a3cb7.exe
-
Size
347KB
-
MD5
7411c8d36761ca9edc88373cfc7a3cb7
-
SHA1
8b31d6b61ee03da19817d3ffd59c0aa41ef32d81
-
SHA256
5ab1aac03c053e025319aac9bbe317a163d56bf4657819c6a43ffb97099ec322
-
SHA512
37f29a792ca641f29144032575f7f42ced5345c541cbdad33e935ef7b5b70d6b5623196596587be95ef00a86a58d604c295c1fcc4a9b159b80cc273fe1623342
Malware Config
Extracted
quasar
1.3.0.0
SUCCESS
jerenyankipong.duckdns.org:4782
MUTEX_jh9iPmixBt74IpSqEj
-
encryption_key
uO9yacYVMmi8921rParX
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
cmd
-
subdirectory
SubDir
Signatures
-
Quasar Payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2664-115-0x0000000000D60000-0x0000000000DBE000-memory.dmp family_quasar behavioral2/memory/2664-116-0x0000000000D60000-0x0000000000DBE000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client.exe family_quasar behavioral2/memory/3516-128-0x0000000000A30000-0x0000000000A8E000-memory.dmp family_quasar behavioral2/memory/3516-127-0x0000000000A30000-0x0000000000A8E000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 3516 Client.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 ip-api.com -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1236 schtasks.exe 3572 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7411c8d36761ca9edc88373cfc7a3cb7.exeClient.exedescription pid process Token: SeDebugPrivilege 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe Token: SeDebugPrivilege 3516 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 3516 Client.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7411c8d36761ca9edc88373cfc7a3cb7.exeClient.exedescription pid process target process PID 2664 wrote to memory of 1236 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe schtasks.exe PID 2664 wrote to memory of 1236 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe schtasks.exe PID 2664 wrote to memory of 1236 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe schtasks.exe PID 2664 wrote to memory of 3516 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe Client.exe PID 2664 wrote to memory of 3516 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe Client.exe PID 2664 wrote to memory of 3516 2664 7411c8d36761ca9edc88373cfc7a3cb7.exe Client.exe PID 3516 wrote to memory of 3572 3516 Client.exe schtasks.exe PID 3516 wrote to memory of 3572 3516 Client.exe schtasks.exe PID 3516 wrote to memory of 3572 3516 Client.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7411c8d36761ca9edc88373cfc7a3cb7.exe"C:\Users\Admin\AppData\Local\Temp\7411c8d36761ca9edc88373cfc7a3cb7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "cmd" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\7411c8d36761ca9edc88373cfc7a3cb7.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "cmd" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeMD5
7411c8d36761ca9edc88373cfc7a3cb7
SHA18b31d6b61ee03da19817d3ffd59c0aa41ef32d81
SHA2565ab1aac03c053e025319aac9bbe317a163d56bf4657819c6a43ffb97099ec322
SHA51237f29a792ca641f29144032575f7f42ced5345c541cbdad33e935ef7b5b70d6b5623196596587be95ef00a86a58d604c295c1fcc4a9b159b80cc273fe1623342
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeMD5
7411c8d36761ca9edc88373cfc7a3cb7
SHA18b31d6b61ee03da19817d3ffd59c0aa41ef32d81
SHA2565ab1aac03c053e025319aac9bbe317a163d56bf4657819c6a43ffb97099ec322
SHA51237f29a792ca641f29144032575f7f42ced5345c541cbdad33e935ef7b5b70d6b5623196596587be95ef00a86a58d604c295c1fcc4a9b159b80cc273fe1623342
-
memory/1236-123-0x0000000000000000-mapping.dmp
-
memory/2664-120-0x0000000005F80000-0x0000000005FE6000-memory.dmpFilesize
408KB
-
memory/2664-116-0x0000000000D60000-0x0000000000DBE000-memory.dmpFilesize
376KB
-
memory/2664-115-0x0000000000D60000-0x0000000000DBE000-memory.dmpFilesize
376KB
-
memory/2664-121-0x0000000006570000-0x0000000006582000-memory.dmpFilesize
72KB
-
memory/2664-122-0x0000000006960000-0x000000000699E000-memory.dmpFilesize
248KB
-
memory/2664-118-0x00000000056B0000-0x0000000005742000-memory.dmpFilesize
584KB
-
memory/2664-119-0x0000000005580000-0x0000000005A7E000-memory.dmpFilesize
5.0MB
-
memory/2664-117-0x0000000005A80000-0x0000000005F7E000-memory.dmpFilesize
5.0MB
-
memory/3516-128-0x0000000000A30000-0x0000000000A8E000-memory.dmpFilesize
376KB
-
memory/3516-124-0x0000000000000000-mapping.dmp
-
memory/3516-127-0x0000000000A30000-0x0000000000A8E000-memory.dmpFilesize
376KB
-
memory/3516-129-0x00000000057C0000-0x0000000005CBE000-memory.dmpFilesize
5.0MB
-
memory/3516-130-0x0000000005360000-0x00000000053F2000-memory.dmpFilesize
584KB
-
memory/3516-131-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/3516-132-0x0000000005500000-0x0000000005566000-memory.dmpFilesize
408KB
-
memory/3516-133-0x00000000061A0000-0x00000000061B2000-memory.dmpFilesize
72KB
-
memory/3516-134-0x0000000006570000-0x00000000065AE000-memory.dmpFilesize
248KB
-
memory/3516-136-0x00000000068E0000-0x00000000068EA000-memory.dmpFilesize
40KB
-
memory/3572-135-0x0000000000000000-mapping.dmp