Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
01-06-2023 15:03
Behavioral task
behavioral1
Sample
08429299.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
08429299.exe
Resource
win10v2004-20230220-en
General
-
Target
08429299.exe
-
Size
3.1MB
-
MD5
4bfcf945a94b7497d44dec0e663e2903
-
SHA1
1456b93f6ef6225a635955662641524e95e4f5ce
-
SHA256
e5556b22dcd6d7d26ce0e58e050632a0a03bf9fa2515953aaca8473e5f959f1d
-
SHA512
2ff0b5dab62e771429e44a3b1245d6839487b13a560075f054c5795cc1c89cd0f3a2b4eb3a951c1483f88fc2dae33a5bac0f4b60d93c5c1acc50c177f4311a3c
-
SSDEEP
49152:EvblL26AaNeWgPhlmVqvMQ7XSKVDxNESE6k/iNLoGd+8THHB72eh2NT:EvBL26AaNeWgPhlmVqkQ7XSKVxFF
Malware Config
Extracted
quasar
1.4.1
Telegram Users
xegefi6666-30878.portmap.host:30878
fa554b4d-a1d6-4917-9f68-8f040924e03d
-
encryption_key
B736867CD516C8B6FB67365ADF945A5FC6943067
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1696-54-0x0000000000060000-0x0000000000384000-memory.dmp family_quasar -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
08429299.exedescription pid process Token: SeDebugPrivilege 1696 08429299.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
08429299.exepid process 1696 08429299.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
08429299.exedescription pid process target process PID 1696 wrote to memory of 456 1696 08429299.exe schtasks.exe PID 1696 wrote to memory of 456 1696 08429299.exe schtasks.exe PID 1696 wrote to memory of 456 1696 08429299.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\08429299.exe"C:\Users\Admin\AppData\Local\Temp\08429299.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Windows Defender" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)