Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-05-2023 14:06
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20230220-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
d5745aeed95df53334f3e3de9808b874
-
SHA1
88877da94ce9c4121d5f5eb3fa9edb9fdf3a80ce
-
SHA256
8cb80c88fea397c4b823bbe69891809fefb8fe98224a1552ac0cced93ed3437c
-
SHA512
fe9512143d7020dadb5968025e3198d11dcebe66a0407c79ba27dc09a7459247c7265988a102749bed44c6b79e4b797a28268cbe2da03a58e47d2b19224ad413
-
SSDEEP
49152:0v/t62XlaSFNWPjljiFa2RoUYI+ZyP+vEzTHHB72eh2NT:0vV62XlaSFNWPjljiFXRoUYI+Zi
Malware Config
Extracted
quasar
1.4.1
Office04
181.215.176.73:59955
efc7c4e1-67b9-4193-a637-9063d2f6052c
-
encryption_key
01A024E271E79DC5F555EC503C0E2AB6090246F2
-
install_name
repl.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
replstart
-
subdirectory
repl
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1552-54-0x0000000000030000-0x000000000034A000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\repl\repl.exe family_quasar C:\Users\Admin\AppData\Roaming\repl\repl.exe family_quasar behavioral1/memory/1716-61-0x0000000000E40000-0x000000000115A000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
repl.exepid process 1716 repl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Client-built.exerepl.exedescription pid process Token: SeDebugPrivilege 1552 Client-built.exe Token: SeDebugPrivilege 1716 repl.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
repl.exepid process 1716 repl.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
repl.exepid process 1716 repl.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Client-built.exerepl.exedescription pid process target process PID 1552 wrote to memory of 668 1552 Client-built.exe schtasks.exe PID 1552 wrote to memory of 668 1552 Client-built.exe schtasks.exe PID 1552 wrote to memory of 668 1552 Client-built.exe schtasks.exe PID 1552 wrote to memory of 1716 1552 Client-built.exe repl.exe PID 1552 wrote to memory of 1716 1552 Client-built.exe repl.exe PID 1552 wrote to memory of 1716 1552 Client-built.exe repl.exe PID 1716 wrote to memory of 1820 1716 repl.exe schtasks.exe PID 1716 wrote to memory of 1820 1716 repl.exe schtasks.exe PID 1716 wrote to memory of 1820 1716 repl.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "replstart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\repl\repl.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\repl\repl.exe"C:\Users\Admin\AppData\Roaming\repl\repl.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "replstart" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\repl\repl.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\repl\repl.exeFilesize
3.1MB
MD5d5745aeed95df53334f3e3de9808b874
SHA188877da94ce9c4121d5f5eb3fa9edb9fdf3a80ce
SHA2568cb80c88fea397c4b823bbe69891809fefb8fe98224a1552ac0cced93ed3437c
SHA512fe9512143d7020dadb5968025e3198d11dcebe66a0407c79ba27dc09a7459247c7265988a102749bed44c6b79e4b797a28268cbe2da03a58e47d2b19224ad413
-
C:\Users\Admin\AppData\Roaming\repl\repl.exeFilesize
3.1MB
MD5d5745aeed95df53334f3e3de9808b874
SHA188877da94ce9c4121d5f5eb3fa9edb9fdf3a80ce
SHA2568cb80c88fea397c4b823bbe69891809fefb8fe98224a1552ac0cced93ed3437c
SHA512fe9512143d7020dadb5968025e3198d11dcebe66a0407c79ba27dc09a7459247c7265988a102749bed44c6b79e4b797a28268cbe2da03a58e47d2b19224ad413
-
memory/1552-54-0x0000000000030000-0x000000000034A000-memory.dmpFilesize
3.1MB
-
memory/1552-55-0x000000001AB70000-0x000000001ABF0000-memory.dmpFilesize
512KB
-
memory/1716-61-0x0000000000E40000-0x000000000115A000-memory.dmpFilesize
3.1MB
-
memory/1716-62-0x000000001B210000-0x000000001B290000-memory.dmpFilesize
512KB
-
memory/1716-63-0x000000001B210000-0x000000001B290000-memory.dmpFilesize
512KB