Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-06-2023 13:00
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
502KB
-
MD5
3630b92ac5ed33de5eb53b563913bb02
-
SHA1
34828f9a66c2c9c0f0cf93419dc96a62bfea476b
-
SHA256
17473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
-
SHA512
034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
SSDEEP
12288:dTEgdfYjbg+qBTaa4EywIGpYR1MIwcdD:+UwzgXywIGpYR6IwcdD
Malware Config
Extracted
quasar
1.4.0
Office05
needforrat.hopto.org:7771
d70dba78-082d-4d62-9d71-b4a1c6961022
-
encryption_key
110272D9471BA005C613D451E07D98ABB8403AED
-
install_name
Client1.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
SubDir
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-54-0x0000000000360000-0x00000000003E4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe family_quasar behavioral1/memory/760-60-0x0000000000930000-0x00000000009B4000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client1.exepid process 760 Client1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exeClient1.exedescription pid process Token: SeDebugPrivilege 1924 tmp.exe Token: SeDebugPrivilege 760 Client1.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Client1.exepid process 760 Client1.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Client1.exepid process 760 Client1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client1.exepid process 760 Client1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
tmp.exeClient1.exedescription pid process target process PID 1924 wrote to memory of 912 1924 tmp.exe schtasks.exe PID 1924 wrote to memory of 912 1924 tmp.exe schtasks.exe PID 1924 wrote to memory of 912 1924 tmp.exe schtasks.exe PID 1924 wrote to memory of 760 1924 tmp.exe Client1.exe PID 1924 wrote to memory of 760 1924 tmp.exe Client1.exe PID 1924 wrote to memory of 760 1924 tmp.exe Client1.exe PID 760 wrote to memory of 1156 760 Client1.exe schtasks.exe PID 760 wrote to memory of 1156 760 Client1.exe schtasks.exe PID 760 wrote to memory of 1156 760 Client1.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tmp.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exeFilesize
502KB
MD53630b92ac5ed33de5eb53b563913bb02
SHA134828f9a66c2c9c0f0cf93419dc96a62bfea476b
SHA25617473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
SHA512034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exeFilesize
502KB
MD53630b92ac5ed33de5eb53b563913bb02
SHA134828f9a66c2c9c0f0cf93419dc96a62bfea476b
SHA25617473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
SHA512034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
memory/760-60-0x0000000000930000-0x00000000009B4000-memory.dmpFilesize
528KB
-
memory/760-61-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB
-
memory/760-62-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB
-
memory/1924-54-0x0000000000360000-0x00000000003E4000-memory.dmpFilesize
528KB
-
memory/1924-55-0x00000000002D0000-0x0000000000350000-memory.dmpFilesize
512KB