Analysis
-
max time kernel
85s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2023 18:12
Behavioral task
behavioral1
Sample
2000-68-0x0000000004390000-0x0000000004414000-memory.exe
Resource
win7-20221111-en
General
-
Target
2000-68-0x0000000004390000-0x0000000004414000-memory.exe
-
Size
528KB
-
MD5
05a821b048d45593586e283834af604a
-
SHA1
2c1fd4517b43cd1237f788a07fa03a9571238bff
-
SHA256
8646623dcb870cff84446170f9b4216764821dc8976bdbb1ad7c2932b1ea4c47
-
SHA512
34de8cbd9196b5b0a2d8c959f29203d8fb3c6f9f2a473b9d24bd2af80568e8c128b6c3d9ef0a02ff82456d124b4505baaf22214bd0d7c2b46f114de2a3ad6690
-
SSDEEP
6144:kTEgdc0YYXAGbgiIN2RSBrF8gOfYNw0FdGDTjB2rpYorUicE1QYb8F9tb7VI8cT0:kTEgdfYqbgfFTbFYTmYeW7Pq8cdy
Malware Config
Extracted
quasar
1.4.0
Office04
91.209.226.129:4477
aab8fb23-9414-4086-92a8-8f9df7355991
-
encryption_key
115C3BBD6300A13A8593E1EA090433CDAA8539CA
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4712-132-0x00000000001C0000-0x0000000000244000-memory.dmp family_quasar -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 46 api.ipify.org 47 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2000-68-0x0000000004390000-0x0000000004414000-memory.exedescription pid process Token: SeDebugPrivilege 4712 2000-68-0x0000000004390000-0x0000000004414000-memory.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4712-132-0x00000000001C0000-0x0000000000244000-memory.dmpFilesize
528KB
-
memory/4712-133-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/4712-134-0x000000001ADE0000-0x000000001AE30000-memory.dmpFilesize
320KB
-
memory/4712-135-0x000000001C360000-0x000000001C412000-memory.dmpFilesize
712KB
-
memory/4712-136-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB