Behavioral task
behavioral1
Sample
XO IMGUI EXTERNAL.exe
Resource
win10v2004-20221111-en
General
-
Target
XO IMGUI EXTERNAL.exe
-
Size
1.3MB
-
MD5
092a56d2ffbc62dad8d8a3864fd046fe
-
SHA1
e90b1e199a1df28a2b748340b3a90a3e6112c058
-
SHA256
dc6032bb4d1d30872419a285faf9e3cc8829d6b826151b61317e85cb5e0cec83
-
SHA512
f6215dfd153385b49bf7b2cdb95bc45a2fb45be4ee295448d1bea946199e660ebcb920746388262e05405dc239478f1d4b156bbb03f66c0fb1702df88fba5470
-
SSDEEP
24576:6gZml969wUGPr2uGKFzFTSpkPNnJJUwEbkWppzscd1:65769PaFTFNn/Uwyzppz
Malware Config
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar
Files
-
XO IMGUI EXTERNAL.exe.exe windows x64
09ab4d60198b4e828b0efefc92eb8c68
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
QueryPerformanceCounter
GetModuleHandleA
Sleep
ExitProcess
GlobalUnlock
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
WideCharToMultiByte
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GlobalLock
GlobalFree
GlobalAlloc
IsDebuggerPresent
MultiByteToWideChar
user32
BringWindowToTop
ClientToScreen
LoadCursorW
MessageBoxA
DispatchMessageW
PeekMessageW
TranslateMessage
PostQuitMessage
UpdateWindow
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
GetKeyState
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
CreateWindowExW
ScreenToClient
UnregisterClassW
SetWindowTextW
RegisterClassExW
WindowFromPoint
ShowWindow
GetCapture
GetMonitorInfoW
IsChild
SetCapture
SetClipboardData
SetFocus
SetCursor
SetWindowLongW
GetClientRect
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
GetCursorPos
OpenClipboard
GetForegroundWindow
SetLayeredWindowAttributes
GetClipboardData
EmptyClipboard
CloseClipboard
gdi32
GetDeviceCaps
xinput1_4
ord4
ord2
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
d3d9
Direct3DCreate9
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
memset
__C_specific_handler
__current_exception_context
__current_exception
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
memchr
memcpy
memcmp
memmove
api-ms-win-crt-stdio-l1-1-0
ungetc
fgetc
fputc
__stdio_common_vsscanf
fread
fsetpos
__stdio_common_vsprintf
_wfopen
fwrite
_fseeki64
fgetpos
__p__commode
fseek
fclose
fflush
__acrt_iob_func
_set_fmode
ftell
_get_stream_buffer_pointers
setvbuf
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_get_narrow_winmain_command_line
_set_app_type
_configure_narrow_argv
_seh_filter_exe
_initialize_narrow_environment
_initialize_onexit_table
_cexit
_register_onexit_function
_initterm
_crt_atexit
system
_invalid_parameter_noinfo_noreturn
terminate
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
cosf
floorf
sqrtf
fmodf
acosf
sinf
__setusermatherr
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 301KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 782KB - Virtual size: 784KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ