Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-02-2024 07:37
Behavioral task
behavioral1
Sample
Broker.exe
Resource
win11-20231215-en
General
-
Target
Broker.exe
-
Size
3.1MB
-
MD5
4b9e68a7fe2d07b65c7181b8623f2faa
-
SHA1
3b636fa355bca0c142f45dff6494ab4634c29ebe
-
SHA256
9f4a5ea6fa9cbf7d164caad36430668f5edd3981f14cb229357f7fc662c0e1cb
-
SHA512
daa00e6369ed6522a43dba37117382b4d31bde5e83dbcdb1e07e6ede281dd879c644351255508c1e5351d6d454dbe2b0a31a92a6bf0800626649052fcfbec2b6
-
SSDEEP
49152:HvvI22SsaNYfdPBldt698dBcjH44GcBelSopd3aTHHB72eh2NT:Hvg22SsaNYfdPBldt6+dBcjHvGc
Malware Config
Extracted
quasar
1.4.1
Rat
rate-ericsson.gl.at.ply.gg:29259
b012b0da-9935-4804-afd4-9fa9d19767ac
-
encryption_key
CBFF95FA1927F9601F379BFD806C11D3B756D820
-
install_name
Broker.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Broker
-
subdirectory
Clint Broker
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-0-0x0000000000C70000-0x0000000000F94000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\Clint Broker\ Broker.exe family_quasar -
Executes dropped EXE 1 IoCs
Processes:
Broker.exepid process 5692 Broker.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Broker.exe Broker.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Broker = "\"C:\\Users\\Admin\\AppData\\Roaming\\Clint Broker\\ Broker.exe\"" Broker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Broker = "\"C:\\Users\\Admin\\AppData\\Roaming\\Clint Broker\\ Broker.exe\"" Broker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3572 schtasks.exe 4100 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Broker.exe Broker.exedescription pid process Token: SeDebugPrivilege 1556 Broker.exe Token: SeDebugPrivilege 5692 Broker.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Broker.exepid process 5692 Broker.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Broker.exepid process 5692 Broker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broker.exepid process 5692 Broker.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Broker.exe Broker.exedescription pid process target process PID 1556 wrote to memory of 3572 1556 Broker.exe schtasks.exe PID 1556 wrote to memory of 3572 1556 Broker.exe schtasks.exe PID 1556 wrote to memory of 5692 1556 Broker.exe Broker.exe PID 1556 wrote to memory of 5692 1556 Broker.exe Broker.exe PID 5692 wrote to memory of 4100 5692 Broker.exe schtasks.exe PID 5692 wrote to memory of 4100 5692 Broker.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Broker.exe"C:\Users\Admin\AppData\Local\Temp\Broker.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn " Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Clint Broker\ Broker.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Clint Broker\ Broker.exe"C:\Users\Admin\AppData\Roaming\Clint Broker\ Broker.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn " Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Clint Broker\ Broker.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Clint Broker\ Broker.exeFilesize
3.1MB
MD54b9e68a7fe2d07b65c7181b8623f2faa
SHA13b636fa355bca0c142f45dff6494ab4634c29ebe
SHA2569f4a5ea6fa9cbf7d164caad36430668f5edd3981f14cb229357f7fc662c0e1cb
SHA512daa00e6369ed6522a43dba37117382b4d31bde5e83dbcdb1e07e6ede281dd879c644351255508c1e5351d6d454dbe2b0a31a92a6bf0800626649052fcfbec2b6
-
memory/1556-0-0x0000000000C70000-0x0000000000F94000-memory.dmpFilesize
3.1MB
-
memory/1556-1-0x00007FFB99E90000-0x00007FFB9A952000-memory.dmpFilesize
10.8MB
-
memory/1556-2-0x000000001BC40000-0x000000001BC50000-memory.dmpFilesize
64KB
-
memory/1556-8-0x00007FFB99E90000-0x00007FFB9A952000-memory.dmpFilesize
10.8MB
-
memory/5692-9-0x00007FFB99E90000-0x00007FFB9A952000-memory.dmpFilesize
10.8MB
-
memory/5692-10-0x000000001B930000-0x000000001B940000-memory.dmpFilesize
64KB
-
memory/5692-11-0x000000001C6B0000-0x000000001C700000-memory.dmpFilesize
320KB
-
memory/5692-12-0x000000001C7C0000-0x000000001C872000-memory.dmpFilesize
712KB
-
memory/5692-13-0x00007FFB99E90000-0x00007FFB9A952000-memory.dmpFilesize
10.8MB
-
memory/5692-14-0x000000001B930000-0x000000001B940000-memory.dmpFilesize
64KB