Analysis
-
max time kernel
131s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
03-08-2023 14:45
Behavioral task
behavioral1
Sample
CsGoCheats.exe
Resource
win7-20230712-en
General
-
Target
CsGoCheats.exe
-
Size
3.3MB
-
MD5
d31c6a4a86b2c01d7c6f3bbf0f2773cb
-
SHA1
b8d2287930ff0ebfc7b857c993c1fc0102a925db
-
SHA256
417099ab2a4161b7d39e0657ea0dcd5b15e90111bedf13f3442fbb2efd708f12
-
SHA512
3481b0fc96e319e7ef431a3e161fe5e094c74e7fa31532d3fde5d581d1754796571bbc056f4ed504f5490ccde5fec333a7ed09a56be0f551369c9c1904b28962
-
SSDEEP
98304:lvg62XlaSFNWPjljiFXRoUYI/MQH+eVl:J4ZYIH+I
Malware Config
Extracted
quasar
1.4.1
Cheats
185.38.142.185:3138
27629fb0-eb8d-4d40-971d-ac7640df2bb4
-
encryption_key
87878A8B39F0E68E388682CADE478983AEB7449F
-
install_name
ModmenuCSGO.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RamAnoT
-
subdirectory
CSGO
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2812-54-0x0000000001250000-0x000000000159C000-memory.dmp family_quasar C:\Program Files\CSGO\ModmenuCSGO.exe family_quasar C:\Program Files\CSGO\ModmenuCSGO.exe family_quasar behavioral1/memory/2620-62-0x0000000000C80000-0x0000000000FCC000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
ModmenuCSGO.exepid process 2620 ModmenuCSGO.exe -
Drops file in Program Files directory 2 IoCs
Processes:
CsGoCheats.exedescription ioc process File created C:\Program Files\CSGO\ModmenuCSGO.exe CsGoCheats.exe File opened for modification C:\Program Files\CSGO\ModmenuCSGO.exe CsGoCheats.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1888 schtasks.exe 2132 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CsGoCheats.exeModmenuCSGO.exedescription pid process Token: SeDebugPrivilege 2812 CsGoCheats.exe Token: SeDebugPrivilege 2620 ModmenuCSGO.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ModmenuCSGO.exepid process 2620 ModmenuCSGO.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
ModmenuCSGO.exepid process 2620 ModmenuCSGO.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ModmenuCSGO.exepid process 2620 ModmenuCSGO.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
CsGoCheats.exeModmenuCSGO.exedescription pid process target process PID 2812 wrote to memory of 2132 2812 CsGoCheats.exe schtasks.exe PID 2812 wrote to memory of 2132 2812 CsGoCheats.exe schtasks.exe PID 2812 wrote to memory of 2132 2812 CsGoCheats.exe schtasks.exe PID 2812 wrote to memory of 2620 2812 CsGoCheats.exe ModmenuCSGO.exe PID 2812 wrote to memory of 2620 2812 CsGoCheats.exe ModmenuCSGO.exe PID 2812 wrote to memory of 2620 2812 CsGoCheats.exe ModmenuCSGO.exe PID 2620 wrote to memory of 1888 2620 ModmenuCSGO.exe schtasks.exe PID 2620 wrote to memory of 1888 2620 ModmenuCSGO.exe schtasks.exe PID 2620 wrote to memory of 1888 2620 ModmenuCSGO.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CsGoCheats.exe"C:\Users\Admin\AppData\Local\Temp\CsGoCheats.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RamAnoT" /sc ONLOGON /tr "C:\Program Files\CSGO\ModmenuCSGO.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Program Files\CSGO\ModmenuCSGO.exe"C:\Program Files\CSGO\ModmenuCSGO.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RamAnoT" /sc ONLOGON /tr "C:\Program Files\CSGO\ModmenuCSGO.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\CSGO\ModmenuCSGO.exeFilesize
3.3MB
MD5d31c6a4a86b2c01d7c6f3bbf0f2773cb
SHA1b8d2287930ff0ebfc7b857c993c1fc0102a925db
SHA256417099ab2a4161b7d39e0657ea0dcd5b15e90111bedf13f3442fbb2efd708f12
SHA5123481b0fc96e319e7ef431a3e161fe5e094c74e7fa31532d3fde5d581d1754796571bbc056f4ed504f5490ccde5fec333a7ed09a56be0f551369c9c1904b28962
-
C:\Program Files\CSGO\ModmenuCSGO.exeFilesize
3.3MB
MD5d31c6a4a86b2c01d7c6f3bbf0f2773cb
SHA1b8d2287930ff0ebfc7b857c993c1fc0102a925db
SHA256417099ab2a4161b7d39e0657ea0dcd5b15e90111bedf13f3442fbb2efd708f12
SHA5123481b0fc96e319e7ef431a3e161fe5e094c74e7fa31532d3fde5d581d1754796571bbc056f4ed504f5490ccde5fec333a7ed09a56be0f551369c9c1904b28962
-
memory/2620-62-0x0000000000C80000-0x0000000000FCC000-memory.dmpFilesize
3.3MB
-
memory/2620-63-0x000007FEF6150000-0x000007FEF6B3C000-memory.dmpFilesize
9.9MB
-
memory/2620-64-0x000000001B030000-0x000000001B0B0000-memory.dmpFilesize
512KB
-
memory/2620-65-0x000007FEF6150000-0x000007FEF6B3C000-memory.dmpFilesize
9.9MB
-
memory/2620-66-0x000000001B030000-0x000000001B0B0000-memory.dmpFilesize
512KB
-
memory/2812-54-0x0000000001250000-0x000000000159C000-memory.dmpFilesize
3.3MB
-
memory/2812-55-0x000007FEF6150000-0x000007FEF6B3C000-memory.dmpFilesize
9.9MB
-
memory/2812-56-0x000000001B160000-0x000000001B1E0000-memory.dmpFilesize
512KB
-
memory/2812-61-0x000007FEF6150000-0x000007FEF6B3C000-memory.dmpFilesize
9.9MB