Analysis
-
max time kernel
1800s -
max time network
1161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2023 09:32
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20231023-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
b29c8e703911c242f88f9f2d1be23121
-
SHA1
8adc17f1e94eeb0d95d35825c91b788d70d28de1
-
SHA256
4b4fb5711222878e343088374f7437bce99a5916d7e5c410b2763fde8d91ec63
-
SHA512
4c37427e88f6f17344be909ebfbb33e053a0b999f28230a548f343dbf1081ec511701cf61101eef3c9e99400ab73759050b34a9e973eb8fabf892bb2a886a74f
-
SSDEEP
49152:DvTlL26AaNeWgPhlmVqvMQ7XSKo9UksoG6STHHB72eh2NT:DvJL26AaNeWgPhlmVqkQ7XSKo9UL
Malware Config
Extracted
quasar
1.4.1
Office04
127.0.0.7:5053
127.0.0.7:5054
6f01cc79-8527-4436-a34a-473fcf92b46f
-
encryption_key
D52EA8296126E8DD7D221BC02E2826F1CAA96C78
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/memory/3696-0-0x0000000000AE0000-0x0000000000E04000-memory.dmp family_quasar behavioral2/files/0x000200000001e6d6-7.dat family_quasar behavioral2/files/0x000200000001e6d6-6.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2956 Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3128 schtasks.exe 2196 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3696 Client-built.exe Token: SeDebugPrivilege 2956 Client.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2956 Client.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2956 Client.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3696 wrote to memory of 3128 3696 Client-built.exe 86 PID 3696 wrote to memory of 3128 3696 Client-built.exe 86 PID 3696 wrote to memory of 2956 3696 Client-built.exe 88 PID 3696 wrote to memory of 2956 3696 Client-built.exe 88 PID 2956 wrote to memory of 2196 2956 Client.exe 89 PID 2956 wrote to memory of 2196 2956 Client.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:3128
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2196
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5b29c8e703911c242f88f9f2d1be23121
SHA18adc17f1e94eeb0d95d35825c91b788d70d28de1
SHA2564b4fb5711222878e343088374f7437bce99a5916d7e5c410b2763fde8d91ec63
SHA5124c37427e88f6f17344be909ebfbb33e053a0b999f28230a548f343dbf1081ec511701cf61101eef3c9e99400ab73759050b34a9e973eb8fabf892bb2a886a74f
-
Filesize
3.1MB
MD5b29c8e703911c242f88f9f2d1be23121
SHA18adc17f1e94eeb0d95d35825c91b788d70d28de1
SHA2564b4fb5711222878e343088374f7437bce99a5916d7e5c410b2763fde8d91ec63
SHA5124c37427e88f6f17344be909ebfbb33e053a0b999f28230a548f343dbf1081ec511701cf61101eef3c9e99400ab73759050b34a9e973eb8fabf892bb2a886a74f