Analysis
-
max time kernel
299s -
max time network
330s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12/10/2022, 04:01
Static task
static1
Behavioral task
behavioral1
Sample
12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe
Resource
win10-20220812-en
General
-
Target
12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe
-
Size
1.7MB
-
MD5
aba4aae2a1f0ab9149cce695d254782e
-
SHA1
41b5ef7a15aa23bbb43e4ca9349a87529bd6a49c
-
SHA256
12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b
-
SHA512
7ebb27e2b7ec50506421eecd95babb4ae8e1aef92eb0f79136ca29b0323d80c5a41b452fc05c9395097406d2413cd558e9bc02899247a4eda19f8da5931741a3
-
SSDEEP
24576:PUxJIRCRoenYQb6VOJ8Kgn1beVuumyEU:
Malware Config
Extracted
quasar
1.4.0
Cio
162.19.131.197:4782
c5fdf017-8f44-47ea-a69e-0b82e4044ca7
-
encryption_key
59A92039F951E5069C9F50FD9F340E759713B058
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 6 IoCs
resource yara_rule behavioral1/memory/784-65-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/784-66-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/784-67-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/784-68-0x000000000047E79E-mapping.dmp family_quasar behavioral1/memory/784-70-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/784-72-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jlnprgcxco = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eqbuy\\Jlnprgcxco.exe\"" 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 912 set thread context of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 1316 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe Token: SeDebugPrivilege 1316 powershell.exe Token: SeDebugPrivilege 784 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 784 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 912 wrote to memory of 1316 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 28 PID 912 wrote to memory of 1316 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 28 PID 912 wrote to memory of 1316 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 28 PID 912 wrote to memory of 1316 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 28 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30 PID 912 wrote to memory of 784 912 12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe"C:\Users\Admin\AppData\Local\Temp\12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
C:\Users\Admin\AppData\Local\Temp\12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exeC:\Users\Admin\AppData\Local\Temp\12db007413571ceab4f4e4aecd5270f015b027a671c17efbc07db4967167b46b.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:784
-