Analysis
-
max time kernel
191s -
max time network
250s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 23:21
General
-
Target
aabb.exe
-
Size
3.1MB
-
MD5
8295dfdc857537c3ecf20b85aae299cc
-
SHA1
3a0afcd9e6717d9485eef03b0f025dbac1f36891
-
SHA256
644b2903e1c8b5d6b63335e409b1d624e1bdf620de4bacab2d54c0bef69e5dae
-
SHA512
6fb6c4d7b122d5c7eb1f05ed938020589c093db5cbae0addcc4c274f383057155aa1f6e9c85840f1a3a3f5fb0996cbfade6f4a124889e105e32cbf194c046936
-
SSDEEP
49152:DvcG42pda6D+/PjlLOlg6yQipV/x0qb6jv04Loyd2iTHHB72eh2NT:Dvn42pda6D+/PjlLOlZyQipVb6z
Malware Config
Extracted
quasar
1.4.1
Office04
0.tcp.eu.ngrok.io:15683
tcp.kochambeton.pl:1337
99a331b1-13b5-4e73-be8f-b5c19bd595ef
-
encryption_key
E31FE4ECA57A8B089443D8B26651DAD7DB7A12F8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Counter Strike Global Offensive
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/3776-0-0x0000000000D80000-0x00000000010A4000-memory.dmp family_quasar -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2516 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3776 aabb.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3776 wrote to memory of 2516 3776 aabb.exe 93 PID 3776 wrote to memory of 2516 3776 aabb.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\aabb.exe"C:\Users\Admin\AppData\Local\Temp\aabb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Counter Strike Global Offensive" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:2516
-