Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
02-12-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
dddd.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
dddd.exe
Resource
win10v2004-20231127-en
General
-
Target
dddd.exe
-
Size
3.2MB
-
MD5
58abd80cc431895f2c2126f714ca3c8c
-
SHA1
9338c3bbe9e6dd3658848c03a5d3bcf02dfbe965
-
SHA256
425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff
-
SHA512
fcd8197173da2c475451f500cbea32b446d872a8553ebd76dae4ac3873ed8da149e8036cad65968f10d6719992e442e0ddfb458ce250c41521668d5117a14ec4
-
SSDEEP
49152:S9GUKQbhUbLP/WdzmmVoNyQNKXVTHUt0ONKgDGsbolFjeTXbjuOvtXcUwowyr4T5:yUbLPudCfUj0t0ON/GUW6lJ3HdjX0
Malware Config
Extracted
quasar
1.4.1
Office04
y20.ddns.net:5552
081f9344-bbf0-4c0d-832c-1597fc2c5291
-
encryption_key
51E85A39CEAF3ACB23D073483E360B1A632697B4
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/2300-13-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar behavioral1/memory/2300-14-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1876 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1408 wrote to memory of 1876 1408 dddd.exe 28 PID 1408 wrote to memory of 1876 1408 dddd.exe 28 PID 1408 wrote to memory of 1876 1408 dddd.exe 28 PID 1408 wrote to memory of 1876 1408 dddd.exe 28 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30 PID 1408 wrote to memory of 2300 1408 dddd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\dddd.exe"C:\Users\Admin\AppData\Local\Temp\dddd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name '' -Value '"C:\Users\Admin\AppData\Roaming\.exe"' -PropertyType 'String'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵PID:2300
-