Analysis
-
max time kernel
297s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:18
Static task
static1
Behavioral task
behavioral1
Sample
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe
Resource
win10-20220812-en
General
-
Target
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe
-
Size
1.7MB
-
MD5
be5deb4eb43a1b071f8a2224787b4986
-
SHA1
ad145fe797c4fadfaec2f29146bd70d35f820d11
-
SHA256
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1
-
SHA512
dd55a9cf9acfe26379bf469337b7ea8ace697a6430eab44cf5aa9b9afa6667ab59faa6100ce78c9e7cef1f7b04b25ef729c6c9dbd61ce7ef45a17bf17d9aa668
-
SSDEEP
24576:PUxJIRCRoenYQb6VOJ8Kgn1beVuumyEU:
Malware Config
Extracted
quasar
1.4.0
Cio
162.19.131.197:4782
c5fdf017-8f44-47ea-a69e-0b82e4044ca7
-
encryption_key
59A92039F951E5069C9F50FD9F340E759713B058
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-64-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/1752-65-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/1752-66-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/1752-67-0x000000000047E79E-mapping.dmp family_quasar behavioral1/memory/1752-69-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar behavioral1/memory/1752-71-0x0000000000400000-0x0000000000484000-memory.dmp family_quasar -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jlnprgcxco = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eqbuy\\Jlnprgcxco.exe\"" bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exedescription pid process target process PID 1324 set thread context of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exepowershell.exepid process 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe 1748 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exepowershell.exebace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exedescription pid process Token: SeDebugPrivilege 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 1752 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exepid process 1752 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exedescription pid process target process PID 1324 wrote to memory of 1748 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe powershell.exe PID 1324 wrote to memory of 1748 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe powershell.exe PID 1324 wrote to memory of 1748 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe powershell.exe PID 1324 wrote to memory of 1748 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe powershell.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe PID 1324 wrote to memory of 1752 1324 bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe"C:\Users\Admin\AppData\Local\Temp\bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exeC:\Users\Admin\AppData\Local\Temp\bace836593264e31d5df7ea8adca4ef4536859addaa2819f5f63a76266cd07a1.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1324-54-0x0000000000840000-0x0000000000A00000-memory.dmpFilesize
1.8MB
-
memory/1324-55-0x0000000000A40000-0x0000000000B22000-memory.dmpFilesize
904KB
-
memory/1324-56-0x00000000007B0000-0x0000000000842000-memory.dmpFilesize
584KB
-
memory/1748-57-0x0000000000000000-mapping.dmp
-
memory/1748-58-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/1748-59-0x000000006F420000-0x000000006F9CB000-memory.dmpFilesize
5.7MB
-
memory/1748-60-0x000000006F420000-0x000000006F9CB000-memory.dmpFilesize
5.7MB
-
memory/1752-61-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1752-62-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1752-64-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1752-65-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1752-66-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1752-67-0x000000000047E79E-mapping.dmp
-
memory/1752-69-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1752-71-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB