Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2023 15:44
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
2.8MB
-
MD5
ec4951e9f2b1945815954fec161cf57a
-
SHA1
8e9e6857a0251a89b9c43b650344fb4f1648fa76
-
SHA256
d969fc2e15743d6d44f477907368f2ebc96cefba20a232861fc7337bfa938d75
-
SHA512
596e28d3529be33483589973ac34410f574cd888bda74e1e24afb2a2de107af4e788e2a27648da3c4fe4db4f49184244ce6ccf50f480c95c8d252d541587ad15
-
SSDEEP
49152:y/Cbs48/vm/XpRDVHFZuAzG5LfvUza32ehyfT36:y/Ob8/vm/XnDVHbs
Malware Config
Extracted
quasar
1.4.0
X
45.141.27.208:4780
127.0.0.1:4780
d6e77ea9-bff7-4566-b4dd-f1be3c293c5e
-
encryption_key
57F667877C1FCDA6663E2FDAC6FB8CFDE3CEA957
-
install_name
winx.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
winx
-
subdirectory
sys
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4148-133-0x0000000000690000-0x000000000095A000-memory.dmp family_quasar C:\Windows\System32\sys\winx.exe family_quasar C:\Windows\system32\sys\winx.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
winx.exepid process 3084 winx.exe -
Drops file in System32 directory 3 IoCs
Processes:
tmp.exedescription ioc process File created C:\Windows\system32\sys\winx.exe tmp.exe File opened for modification C:\Windows\system32\sys\winx.exe tmp.exe File opened for modification C:\Windows\system32\sys tmp.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2196 schtasks.exe 4732 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exewinx.exedescription pid process Token: SeDebugPrivilege 4148 tmp.exe Token: SeDebugPrivilege 3084 winx.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winx.exepid process 3084 winx.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
tmp.exewinx.exedescription pid process target process PID 4148 wrote to memory of 2196 4148 tmp.exe schtasks.exe PID 4148 wrote to memory of 2196 4148 tmp.exe schtasks.exe PID 4148 wrote to memory of 3084 4148 tmp.exe winx.exe PID 4148 wrote to memory of 3084 4148 tmp.exe winx.exe PID 3084 wrote to memory of 4732 3084 winx.exe schtasks.exe PID 3084 wrote to memory of 4732 3084 winx.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "winx" /sc ONLOGON /tr "C:\Windows\system32\sys\winx.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\sys\winx.exe"C:\Windows\system32\sys\winx.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "winx" /sc ONLOGON /tr "C:\Windows\system32\sys\winx.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\sys\winx.exeFilesize
2.8MB
MD5ec4951e9f2b1945815954fec161cf57a
SHA18e9e6857a0251a89b9c43b650344fb4f1648fa76
SHA256d969fc2e15743d6d44f477907368f2ebc96cefba20a232861fc7337bfa938d75
SHA512596e28d3529be33483589973ac34410f574cd888bda74e1e24afb2a2de107af4e788e2a27648da3c4fe4db4f49184244ce6ccf50f480c95c8d252d541587ad15
-
C:\Windows\system32\sys\winx.exeFilesize
2.8MB
MD5ec4951e9f2b1945815954fec161cf57a
SHA18e9e6857a0251a89b9c43b650344fb4f1648fa76
SHA256d969fc2e15743d6d44f477907368f2ebc96cefba20a232861fc7337bfa938d75
SHA512596e28d3529be33483589973ac34410f574cd888bda74e1e24afb2a2de107af4e788e2a27648da3c4fe4db4f49184244ce6ccf50f480c95c8d252d541587ad15
-
memory/3084-141-0x000000001B390000-0x000000001B3A0000-memory.dmpFilesize
64KB
-
memory/3084-142-0x000000001B2B0000-0x000000001B300000-memory.dmpFilesize
320KB
-
memory/3084-143-0x000000001BB50000-0x000000001BC02000-memory.dmpFilesize
712KB
-
memory/3084-146-0x000000001B330000-0x000000001B342000-memory.dmpFilesize
72KB
-
memory/3084-147-0x000000001BA90000-0x000000001BACC000-memory.dmpFilesize
240KB
-
memory/3084-148-0x000000001B390000-0x000000001B3A0000-memory.dmpFilesize
64KB
-
memory/4148-133-0x0000000000690000-0x000000000095A000-memory.dmpFilesize
2.8MB
-
memory/4148-134-0x000000001B860000-0x000000001B870000-memory.dmpFilesize
64KB