Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2023 13:00
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
502KB
-
MD5
3630b92ac5ed33de5eb53b563913bb02
-
SHA1
34828f9a66c2c9c0f0cf93419dc96a62bfea476b
-
SHA256
17473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
-
SHA512
034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
SSDEEP
12288:dTEgdfYjbg+qBTaa4EywIGpYR1MIwcdD:+UwzgXywIGpYR6IwcdD
Malware Config
Extracted
quasar
1.4.0
Office05
needforrat.hopto.org:7771
d70dba78-082d-4d62-9d71-b4a1c6961022
-
encryption_key
110272D9471BA005C613D451E07D98ABB8403AED
-
install_name
Client1.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4876-133-0x0000000000720000-0x00000000007A4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Client1.exepid process 3824 Client1.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 api.ipify.org 23 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2180 schtasks.exe 2884 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exeClient1.exedescription pid process Token: SeDebugPrivilege 4876 tmp.exe Token: SeDebugPrivilege 3824 Client1.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Client1.exepid process 3824 Client1.exe 3824 Client1.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Client1.exepid process 3824 Client1.exe 3824 Client1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client1.exepid process 3824 Client1.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
tmp.exeClient1.exedescription pid process target process PID 4876 wrote to memory of 2180 4876 tmp.exe schtasks.exe PID 4876 wrote to memory of 2180 4876 tmp.exe schtasks.exe PID 4876 wrote to memory of 3824 4876 tmp.exe Client1.exe PID 4876 wrote to memory of 3824 4876 tmp.exe Client1.exe PID 3824 wrote to memory of 2884 3824 Client1.exe schtasks.exe PID 3824 wrote to memory of 2884 3824 Client1.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\tmp.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client1.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exeFilesize
502KB
MD53630b92ac5ed33de5eb53b563913bb02
SHA134828f9a66c2c9c0f0cf93419dc96a62bfea476b
SHA25617473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
SHA512034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
C:\Users\Admin\AppData\Roaming\SubDir\Client1.exeFilesize
502KB
MD53630b92ac5ed33de5eb53b563913bb02
SHA134828f9a66c2c9c0f0cf93419dc96a62bfea476b
SHA25617473731182bcea4cee088d78f802ea947926a5cbc8708b4ba31d7585ee8b19f
SHA512034d8e4509816f18f2f75996914d9ef179985a5d53e002b982e208030d2b60413faec917ad6ac1e02f609261d57bb88221c7840271ab64f3cc0b54e3c2b5501b
-
memory/3824-140-0x000000001B500000-0x000000001B510000-memory.dmpFilesize
64KB
-
memory/3824-141-0x000000001C1A0000-0x000000001C1F0000-memory.dmpFilesize
320KB
-
memory/3824-142-0x000000001C2B0000-0x000000001C362000-memory.dmpFilesize
712KB
-
memory/3824-143-0x000000001B500000-0x000000001B510000-memory.dmpFilesize
64KB
-
memory/4876-133-0x0000000000720000-0x00000000007A4000-memory.dmpFilesize
528KB
-
memory/4876-134-0x000000001B350000-0x000000001B360000-memory.dmpFilesize
64KB