Analysis
- max time kernel
107s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
07/07/2023, 22:30
Behavioral task
behavioral1
Sample
2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe
Resource
win7-20230703-en
windows7-x64
10 signatures
300 seconds
General
- Target 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe
- Size 527KB
- Sample230707-2ertnsdb31
- SHA256 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7
- MD5 a295050993bf161631ded523b4fa0902
- SHA1 11d29faf445f59764952b50f8a1cebd1ef5243f8
- SHA512 637df08437319a88433ab2572af8ea9c992e183ce9ac15dceab77550048122840fe6d5257500ebd8df2611c6d82f525282b7d656b7655e2e5949afdb00a084d4
- SSDEEP 12288:0TEgdfYuxUdNzcBdx7lcym6pV2Snsfcdl:5Uwx1cnxBcym6zkcdl
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.0
Botnet
-
Office04
C2
-
78.173.187.50:4782
Mutex
-
6be569a3-de63-4afe-821f-a59ae80a0a02
Attributes
-
encryption_key
E33B6D4D8E5F4B8C8F2D0E3745DBCD85B3A2B564
-
install_name
Java.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Java Updater
-
subdirectory
Java Update
Signatures
- Quasar payload 3 IoCs
resource yara_rule behavioral2/memory/1228-133-0x0000000000FE0000-0x000000000106A000-memory.dmp family_quasar behavioral2/files/0x0006000000023206-137.dat family_quasar behavioral2/files/0x0006000000023206-138.dat family_quasar - Executes dropped EXE 1 IoCs
pid Process 556 Java.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{E52498C1-6DD1-4F18-9DD8-70DD0927BE1C}.catalogItem svchost.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5052 schtasks.exe 4776 schtasks.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2752 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1228 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe Token: SeDebugPrivilege 556 Java.exe Token: SeDebugPrivilege 2752 taskmgr.exe Token: SeSystemProfilePrivilege 2752 taskmgr.exe Token: SeCreateGlobalPrivilege 2752 taskmgr.exe Token: 33 2752 taskmgr.exe Token: SeIncBasePriorityPrivilege 2752 taskmgr.exe - Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 556 Java.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 556 Java.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe 2752 taskmgr.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 556 Java.exe 2196 OpenWith.exe 2196 OpenWith.exe 2196 OpenWith.exe 2196 OpenWith.exe 2196 OpenWith.exe 2196 OpenWith.exe 2196 OpenWith.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1228 wrote to memory of 5052 1228 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe 87 PID 1228 wrote to memory of 5052 1228 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe 87 PID 1228 wrote to memory of 556 1228 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe 89 PID 1228 wrote to memory of 556 1228 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe 89 PID 556 wrote to memory of 4776 556 Java.exe 90 PID 556 wrote to memory of 4776 556 Java.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3336
-
C:\Users\Admin\AppData\Local\Temp\2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe"C:\Users\Admin\AppData\Local\Temp\2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:5052
-
-
C:\Users\Admin\AppData\Roaming\Java Update\Java.exe"C:\Users\Admin\AppData\Roaming\Java Update\Java.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java Update\Java.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4776
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2752
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:400
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2196
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Java Update\Java.exe
- Size 527KB
- SHA256 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7
- MD5 a295050993bf161631ded523b4fa0902
- SHA1 11d29faf445f59764952b50f8a1cebd1ef5243f8
- SHA512 637df08437319a88433ab2572af8ea9c992e183ce9ac15dceab77550048122840fe6d5257500ebd8df2611c6d82f525282b7d656b7655e2e5949afdb00a084d4
- SSDEEP 12288:0TEgdfYuxUdNzcBdx7lcym6pV2Snsfcdl:5Uwx1cnxBcym6zkcdl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Java Update\Java.exe
- Size 527KB
- SHA256 2b128ab47295a12e90b108021afc735fbebb98c313c0098b979d6f472e420bd7
- MD5 a295050993bf161631ded523b4fa0902
- SHA1 11d29faf445f59764952b50f8a1cebd1ef5243f8
- SHA512 637df08437319a88433ab2572af8ea9c992e183ce9ac15dceab77550048122840fe6d5257500ebd8df2611c6d82f525282b7d656b7655e2e5949afdb00a084d4
- SSDEEP 12288:0TEgdfYuxUdNzcBdx7lcym6pV2Snsfcdl:5Uwx1cnxBcym6zkcdl
- MD5 SHA1 SHA512 SSDEEP