Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2023, 01:14
Behavioral task
behavioral1
Sample
3630b92ac5ed33de5eb53b563913bb02.exe
Resource
win7-20230220-en
General
-
Target
3630b92ac5ed33de5eb53b563913bb02.exe
-
Size
502KB
-
MD5
3630b92ac5ed33de5eb53b563913bb02
-
SHA1
34828f9a66c2c9c0f0cf93419dc96a62bfea476b
-
SHA256
17473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
-
SHA512
034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
SSDEEP
12288:dTEgdfYjbg+qBTaa4EywIGpYR1MIwcdD:+UwzgXywIGpYR6IwcdD
Malware Config
Extracted
quasar
1.4.0
Office05
needforrat.hopto.org:7771
d70dba78-082d-4d62-9d71-b4a1c6961022
-
encryption_key
110272D9471BA005C613D451E07D98ABB8403AED
-
install_name
Client1.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/memory/4384-133-0x0000000000D60000-0x0000000000DE4000-memory.dmp family_quasar behavioral2/files/0x000200000001e2ac-136.dat family_quasar behavioral2/files/0x000200000001e2ac-138.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 964 Client1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1352 schtasks.exe 1916 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4384 3630b92ac5ed33de5eb53b563913bb02.exe Token: SeDebugPrivilege 964 Client1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 964 Client1.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 964 Client1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 964 Client1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4384 wrote to memory of 1352 4384 3630b92ac5ed33de5eb53b563913bb02.exe 82 PID 4384 wrote to memory of 1352 4384 3630b92ac5ed33de5eb53b563913bb02.exe 82 PID 4384 wrote to memory of 964 4384 3630b92ac5ed33de5eb53b563913bb02.exe 84 PID 4384 wrote to memory of 964 4384 3630b92ac5ed33de5eb53b563913bb02.exe 84 PID 964 wrote to memory of 1916 964 Client1.exe 85 PID 964 wrote to memory of 1916 964 Client1.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3630b92ac5ed33de5eb53b563913bb02.exe"C:\Users\Admin\AppData\Local\Temp\3630b92ac5ed33de5eb53b563913bb02.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\3630b92ac5ed33de5eb53b563913bb02.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:1352
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1916
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
502KB
MD53630b92ac5ed33de5eb53b563913bb02
SHA134828f9a66c2c9c0f0cf93419dc96a62bfea476b
SHA25617473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
SHA512034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
Filesize
502KB
MD53630b92ac5ed33de5eb53b563913bb02
SHA134828f9a66c2c9c0f0cf93419dc96a62bfea476b
SHA25617473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
SHA512034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b