Analysis
-
max time kernel
154s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:42
Static task
static1
Behavioral task
behavioral1
Sample
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe
Resource
win7-20221111-en
General
-
Target
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe
-
Size
648KB
-
MD5
763dd9b7f2a5183a1380bee36889f936
-
SHA1
cdc7f9911a853973fc83d0e1a51ee5e82da347c9
-
SHA256
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
-
SHA512
7ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
SSDEEP
12288:Z8iNlD5ZS/1WEJOAqRSEM3Sy21LVbK89elrrJ56:vKIDAEQSy2TbKuKN
Malware Config
Extracted
quasar
2.1.0.0
ajith
23.105.131.178:7812
VNM_MUTEX_NdVd2sPSSqFdo7I35g
-
encryption_key
jyerms3KOWmt3C9DBFuq
-
install_name
Windows Defender Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/5020-137-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def -
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/5020-137-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
Processes:
Windows Defender Security.exeWindows Defender Security.exepid process 4244 Windows Defender Security.exe 4460 Windows Defender Security.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 25 ip-api.com -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exeWindows Defender Security.exedescription pid process target process PID 3996 set thread context of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 4244 set thread context of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1924 schtasks.exe 2024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exe4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exepid process 4776 powershell.exe 4776 powershell.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exepowershell.exeWindows Defender Security.exedescription pid process Token: SeDebugPrivilege 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Token: SeDebugPrivilege 4776 powershell.exe Token: SeDebugPrivilege 4460 Windows Defender Security.exe Token: SeDebugPrivilege 4460 Windows Defender Security.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Windows Defender Security.exepid process 4460 Windows Defender Security.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exeWindows Defender Security.exeWindows Defender Security.execmd.exedescription pid process target process PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 3996 wrote to memory of 5020 3996 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 5020 wrote to memory of 1924 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 5020 wrote to memory of 1924 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 5020 wrote to memory of 1924 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 5020 wrote to memory of 4244 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 5020 wrote to memory of 4244 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 5020 wrote to memory of 4244 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 5020 wrote to memory of 4776 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 5020 wrote to memory of 4776 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 5020 wrote to memory of 4776 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4244 wrote to memory of 4460 4244 Windows Defender Security.exe Windows Defender Security.exe PID 4460 wrote to memory of 2024 4460 Windows Defender Security.exe schtasks.exe PID 4460 wrote to memory of 2024 4460 Windows Defender Security.exe schtasks.exe PID 4460 wrote to memory of 2024 4460 Windows Defender Security.exe schtasks.exe PID 5020 wrote to memory of 4572 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 5020 wrote to memory of 4572 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 5020 wrote to memory of 4572 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 4572 wrote to memory of 3952 4572 cmd.exe cmd.exe PID 4572 wrote to memory of 3952 4572 cmd.exe cmd.exe PID 4572 wrote to memory of 3952 4572 cmd.exe cmd.exe PID 5020 wrote to memory of 2384 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 5020 wrote to memory of 2384 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 5020 wrote to memory of 2384 5020 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HKP7gLUvolmk.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe.logFilesize
507B
MD58cf94b5356be60247d331660005941ec
SHA1fdedb361f40f22cb6a086c808fc0056d4e421131
SHA25652a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0
SHA512b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651
-
C:\Users\Admin\AppData\Local\Temp\HKP7gLUvolmk.batFilesize
261B
MD5f01ee872fb37222826c659f13b52ba66
SHA194ff5a1114369a8b8a289a5da76b56749c4a396e
SHA25631acbbbd4e2aec545d0189ed8af81316f7c772ec8e8881270d90c4dda9300d85
SHA512f2a00b3802f96750d84c958d605c4cdef520a209f5db76a9904e24a6079a4bf99df1a1a9d2df399418427c9768f448ce442b63bf2d8c6f5fc0b68f40b3f49bc7
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
memory/1924-141-0x0000000000000000-mapping.dmp
-
memory/2024-154-0x0000000000000000-mapping.dmp
-
memory/2384-168-0x0000000000000000-mapping.dmp
-
memory/3952-167-0x0000000000000000-mapping.dmp
-
memory/3996-134-0x00000000056A0000-0x0000000005732000-memory.dmpFilesize
584KB
-
memory/3996-135-0x0000000005740000-0x00000000057DC000-memory.dmpFilesize
624KB
-
memory/3996-133-0x0000000005C50000-0x00000000061F4000-memory.dmpFilesize
5.6MB
-
memory/3996-132-0x0000000000BA0000-0x0000000000C48000-memory.dmpFilesize
672KB
-
memory/4244-142-0x0000000000000000-mapping.dmp
-
memory/4460-146-0x0000000000000000-mapping.dmp
-
memory/4460-155-0x0000000006780000-0x000000000678A000-memory.dmpFilesize
40KB
-
memory/4572-166-0x0000000000000000-mapping.dmp
-
memory/4776-151-0x00000000058E0000-0x0000000005902000-memory.dmpFilesize
136KB
-
memory/4776-161-0x0000000007C30000-0x0000000007C3A000-memory.dmpFilesize
40KB
-
memory/4776-152-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/4776-153-0x00000000068B0000-0x00000000068CE000-memory.dmpFilesize
120KB
-
memory/4776-149-0x0000000002FA0000-0x0000000002FD6000-memory.dmpFilesize
216KB
-
memory/4776-145-0x0000000000000000-mapping.dmp
-
memory/4776-156-0x0000000006E70000-0x0000000006EA2000-memory.dmpFilesize
200KB
-
memory/4776-157-0x000000006FCE0000-0x000000006FD2C000-memory.dmpFilesize
304KB
-
memory/4776-158-0x0000000006EB0000-0x0000000006ECE000-memory.dmpFilesize
120KB
-
memory/4776-159-0x0000000008200000-0x000000000887A000-memory.dmpFilesize
6.5MB
-
memory/4776-160-0x0000000007BC0000-0x0000000007BDA000-memory.dmpFilesize
104KB
-
memory/4776-150-0x0000000005BE0000-0x0000000006208000-memory.dmpFilesize
6.2MB
-
memory/4776-162-0x0000000007E40000-0x0000000007ED6000-memory.dmpFilesize
600KB
-
memory/4776-163-0x0000000007DF0000-0x0000000007DFE000-memory.dmpFilesize
56KB
-
memory/4776-164-0x0000000007F00000-0x0000000007F1A000-memory.dmpFilesize
104KB
-
memory/4776-165-0x0000000007EE0000-0x0000000007EE8000-memory.dmpFilesize
32KB
-
memory/5020-140-0x0000000006160000-0x000000000619C000-memory.dmpFilesize
240KB
-
memory/5020-139-0x0000000005BF0000-0x0000000005C02000-memory.dmpFilesize
72KB
-
memory/5020-138-0x0000000005010000-0x0000000005076000-memory.dmpFilesize
408KB
-
memory/5020-137-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5020-136-0x0000000000000000-mapping.dmp