Analysis
-
max time kernel
147s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
14-12-2023 08:15
Behavioral task
behavioral1
Sample
Syences.exe
Resource
win7-20231130-en
General
-
Target
Syences.exe
-
Size
3.1MB
-
MD5
f0207a4a17b47cba7d87142363b12477
-
SHA1
c2203e69e92e6ba6394e6f711429fadf8b65845e
-
SHA256
d2835aa9243d529d8d44846d383f97f1bb7b976bc4c378d29d2387d1ba6c1d09
-
SHA512
35f37bb38a070220dbe9f6511ab5bf8bca07fae46b5edefa5356a9294fc98b97735719410887b40776a7232711620f5c92f6bb45a7a54d597faef675196da810
-
SSDEEP
49152:Kvpt62XlaSFNWPjljiFa2RoUYIAunRJ65bR3LoGdcTHHB72eh2NT:Kvj62XlaSFNWPjljiFXRoUYIAunRJ67
Malware Config
Extracted
quasar
1.4.1
Office04
127.0.0.1:4782
4b2195e4-fb92-4868-914b-7332837f4388
-
encryption_key
26FFD71DADD23C1D90404D858942E1C47093C7CF
-
install_name
Synecs.exe
-
log_directory
pergs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 4 IoCs
resource yara_rule behavioral1/memory/2836-0-0x0000000000080000-0x00000000003A6000-memory.dmp family_quasar behavioral1/memory/2164-7-0x00000000013C0000-0x00000000016E6000-memory.dmp family_quasar behavioral1/files/0x00090000000146a2-6.dat family_quasar behavioral1/files/0x00090000000146a2-5.dat family_quasar -
Executes dropped EXE 1 IoCs
pid Process 2164 Synecs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2836 Syences.exe Token: SeDebugPrivilege 2164 Synecs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2164 Synecs.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2164 2836 Syences.exe 28 PID 2836 wrote to memory of 2164 2836 Syences.exe 28 PID 2836 wrote to memory of 2164 2836 Syences.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Syences.exe"C:\Users\Admin\AppData\Local\Temp\Syences.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Roaming\SubDir\Synecs.exe"C:\Users\Admin\AppData\Roaming\SubDir\Synecs.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2164
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257KB
MD5494b53b10bb481411a100d25903b13d0
SHA1e6275e6476f69dfd041130a2c3d233f9a8272813
SHA256bc13fef4c2983cb34cfe6d4aa7b479661bdcb9ee0d9634eeb2a7831dbd5e4f36
SHA512e3244b86e62814a29a8bec2d4b21714c24a3df3312df8cc44b49e27d35edf9b7ac9a645fd3eaef564f0e62717170ff5c8d4e6b32d8b79d3b809f92b45e5f0f2d
-
Filesize
202KB
MD51f67224f6ee752d3c444263351ca600c
SHA132938293d6ef272fe4cbb0f605020bd3caf24929
SHA2560ef1f9014c07fc422e7d9d767bd3fc012e138e2429ee63c752d838407fcba66d
SHA51251ff4c3cf0cc149b1a8ddb6460828119972c7437de7aa142e1f02f64265609629e76732e1254f61bbda392f30d0659ee9bf58273680297e6fd18e602ba660e26