Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-02-2023 00:51
Behavioral task
behavioral1
Sample
Cold War Tool Free by R7XZ2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Cold War Tool Free by R7XZ2.exe
Resource
win10v2004-20220901-en
General
-
Target
Cold War Tool Free by R7XZ2.exe
-
Size
664KB
-
MD5
28b47c7dd2743e312aa5665d2237bbaf
-
SHA1
8c0b0bd93738f6d3c7299073fa046a9923c43d94
-
SHA256
0e75d20dc4bbc6e47d8af2a28ff28efac659bb5b6d1ba69a904ac3d338e0e2cb
-
SHA512
75766bfcf5b90f0ab6c755e6d531377e73838aba956d1597e10d451172ba4df1243a26bc95b996e55f8b013c862e21e06eb48dfa1f00dce131e6e296f3a101f8
-
SSDEEP
6144:yTEgdc0YXXbZvdo6EsRwdfuniFBlh/6KnFwQHocE8cb8F9bObLGnJ2cTR3j:yTEgdfY9do6Wu6hFwMHMn+4cdj
Malware Config
Extracted
quasar
1.4.0
ColdWar Tool by FXC11
91.121.214.19:1605
ee2a25d7-e4a9-452c-9a5f-a26bb677dfa1
-
encryption_key
F9F475501C6D2B1102A497EB1C3D52C90B8E007E
-
install_name
QuickPump.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender Real Time Protection
-
subdirectory
SubDir
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/752-54-0x0000000000270000-0x000000000031C000-memory.dmp family_quasar C:\Program Files\SubDir\QuickPump.exe family_quasar C:\Program Files\SubDir\QuickPump.exe family_quasar behavioral1/memory/2028-60-0x00000000012C0000-0x000000000136C000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
QuickPump.exepid process 2028 QuickPump.exe -
Drops file in Program Files directory 3 IoCs
Processes:
Cold War Tool Free by R7XZ2.exeQuickPump.exedescription ioc process File created C:\Program Files\SubDir\QuickPump.exe Cold War Tool Free by R7XZ2.exe File opened for modification C:\Program Files\SubDir\QuickPump.exe Cold War Tool Free by R7XZ2.exe File opened for modification C:\Program Files\SubDir\QuickPump.exe QuickPump.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1748 schtasks.exe 1996 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cold War Tool Free by R7XZ2.exeQuickPump.exedescription pid process Token: SeDebugPrivilege 752 Cold War Tool Free by R7XZ2.exe Token: SeDebugPrivilege 2028 QuickPump.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
QuickPump.exepid process 2028 QuickPump.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Cold War Tool Free by R7XZ2.exeQuickPump.exedescription pid process target process PID 752 wrote to memory of 1748 752 Cold War Tool Free by R7XZ2.exe schtasks.exe PID 752 wrote to memory of 1748 752 Cold War Tool Free by R7XZ2.exe schtasks.exe PID 752 wrote to memory of 1748 752 Cold War Tool Free by R7XZ2.exe schtasks.exe PID 752 wrote to memory of 2028 752 Cold War Tool Free by R7XZ2.exe QuickPump.exe PID 752 wrote to memory of 2028 752 Cold War Tool Free by R7XZ2.exe QuickPump.exe PID 752 wrote to memory of 2028 752 Cold War Tool Free by R7XZ2.exe QuickPump.exe PID 2028 wrote to memory of 1996 2028 QuickPump.exe schtasks.exe PID 2028 wrote to memory of 1996 2028 QuickPump.exe schtasks.exe PID 2028 wrote to memory of 1996 2028 QuickPump.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cold War Tool Free by R7XZ2.exe"C:\Users\Admin\AppData\Local\Temp\Cold War Tool Free by R7XZ2.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Defender Real Time Protection" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Cold War Tool Free by R7XZ2.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1748 -
C:\Program Files\SubDir\QuickPump.exe"C:\Program Files\SubDir\QuickPump.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Defender Real Time Protection" /sc ONLOGON /tr "C:\Program Files\SubDir\QuickPump.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1996
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\SubDir\QuickPump.exeFilesize
664KB
MD528b47c7dd2743e312aa5665d2237bbaf
SHA18c0b0bd93738f6d3c7299073fa046a9923c43d94
SHA2560e75d20dc4bbc6e47d8af2a28ff28efac659bb5b6d1ba69a904ac3d338e0e2cb
SHA51275766bfcf5b90f0ab6c755e6d531377e73838aba956d1597e10d451172ba4df1243a26bc95b996e55f8b013c862e21e06eb48dfa1f00dce131e6e296f3a101f8
-
C:\Program Files\SubDir\QuickPump.exeFilesize
664KB
MD528b47c7dd2743e312aa5665d2237bbaf
SHA18c0b0bd93738f6d3c7299073fa046a9923c43d94
SHA2560e75d20dc4bbc6e47d8af2a28ff28efac659bb5b6d1ba69a904ac3d338e0e2cb
SHA51275766bfcf5b90f0ab6c755e6d531377e73838aba956d1597e10d451172ba4df1243a26bc95b996e55f8b013c862e21e06eb48dfa1f00dce131e6e296f3a101f8
-
memory/752-54-0x0000000000270000-0x000000000031C000-memory.dmpFilesize
688KB
-
memory/752-55-0x000007FEFC161000-0x000007FEFC163000-memory.dmpFilesize
8KB
-
memory/1748-56-0x0000000000000000-mapping.dmp
-
memory/1996-62-0x0000000000000000-mapping.dmp
-
memory/2028-57-0x0000000000000000-mapping.dmp
-
memory/2028-60-0x00000000012C0000-0x000000000136C000-memory.dmpFilesize
688KB