Analysis
-
max time kernel
164s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 22:29
Behavioral task
behavioral1
Sample
bcf82013e39cef4310eb312625ab8598.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bcf82013e39cef4310eb312625ab8598.exe
Resource
win10v2004-20240226-en
General
-
Target
bcf82013e39cef4310eb312625ab8598.exe
-
Size
157KB
-
MD5
bcf82013e39cef4310eb312625ab8598
-
SHA1
96f423ba66892855a6d67e96a23bdba885f63944
-
SHA256
088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
-
SHA512
1cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3
-
SSDEEP
3072:GfckI9Z12hDq4SWe06jQ75GKqEcjk0XkhFBx4:K0Z12jjM400Tw
Malware Config
Extracted
quasar
1.4.0.0
Games
services18.dns.army:7000
ss1999.64-b.it:7000
5EwVZpKkbJ5fq0j9og
-
encryption_key
O6mxl5VNcg9uGSOey4nY
-
install_name
Instalation Rep.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Firefox Update
-
subdirectory
Instalation
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3132-1-0x0000000000D80000-0x0000000000DAE000-memory.dmp family_quasar behavioral2/memory/3132-2-0x0000000005720000-0x000000000576C000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Instalation Rep.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Instalation Rep.exe -
Executes dropped EXE 1 IoCs
Processes:
Instalation Rep.exepid process 3148 Instalation Rep.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bcf82013e39cef4310eb312625ab8598.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Firefox Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bcf82013e39cef4310eb312625ab8598.exe\"" bcf82013e39cef4310eb312625ab8598.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 82 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 512 schtasks.exe 1152 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bcf82013e39cef4310eb312625ab8598.exeInstalation Rep.exedescription pid process Token: SeDebugPrivilege 3132 bcf82013e39cef4310eb312625ab8598.exe Token: SeDebugPrivilege 3148 Instalation Rep.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Instalation Rep.exepid process 3148 Instalation Rep.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
bcf82013e39cef4310eb312625ab8598.exeInstalation Rep.execmd.exedescription pid process target process PID 3132 wrote to memory of 512 3132 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 3132 wrote to memory of 512 3132 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 3132 wrote to memory of 512 3132 bcf82013e39cef4310eb312625ab8598.exe schtasks.exe PID 3132 wrote to memory of 3148 3132 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 3132 wrote to memory of 3148 3132 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 3132 wrote to memory of 3148 3132 bcf82013e39cef4310eb312625ab8598.exe Instalation Rep.exe PID 3148 wrote to memory of 1152 3148 Instalation Rep.exe schtasks.exe PID 3148 wrote to memory of 1152 3148 Instalation Rep.exe schtasks.exe PID 3148 wrote to memory of 1152 3148 Instalation Rep.exe schtasks.exe PID 3148 wrote to memory of 4640 3148 Instalation Rep.exe cmd.exe PID 3148 wrote to memory of 4640 3148 Instalation Rep.exe cmd.exe PID 3148 wrote to memory of 4640 3148 Instalation Rep.exe cmd.exe PID 4640 wrote to memory of 4484 4640 cmd.exe chcp.com PID 4640 wrote to memory of 4484 4640 cmd.exe chcp.com PID 4640 wrote to memory of 4484 4640 cmd.exe chcp.com PID 4640 wrote to memory of 3096 4640 cmd.exe PING.EXE PID 4640 wrote to memory of 3096 4640 cmd.exe PING.EXE PID 4640 wrote to memory of 3096 4640 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\bcf82013e39cef4310eb312625ab8598.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Firefox Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yrLIMI8veaKB.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yrLIMI8veaKB.batFilesize
221B
MD52cf01e9d86ebd0e30b6e8a26f169422e
SHA1c6ab9f2d51252057c590ec0a28da175a95ec45cc
SHA256c4a23b3de8331112447c45fe4007d4d5e9895b7563efbe3aefe7be78bfbf839c
SHA512d37b196e011383309d7cf9051a61101b1fafe5fb1710095a70024446e0f413f0f284dbaf0ce5f214ad6afb933c01eb1666aa0b46aa5ace9fb7d567e24a1edefa
-
C:\Users\Admin\AppData\Roaming\Instalation\Instalation Rep.exeFilesize
157KB
MD5bcf82013e39cef4310eb312625ab8598
SHA196f423ba66892855a6d67e96a23bdba885f63944
SHA256088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
SHA5121cddb94d23d6387dcb0650a74ae2028e6a9744788ce7fe5f4bb98afa41c9670e7097fe1be9b323b2c061742a2c026ea710ff294a3b169085fecdb417beb95ac3
-
memory/3132-8-0x0000000005960000-0x0000000005970000-memory.dmpFilesize
64KB
-
memory/3132-9-0x0000000008270000-0x0000000008282000-memory.dmpFilesize
72KB
-
memory/3132-4-0x0000000007D90000-0x0000000007E22000-memory.dmpFilesize
584KB
-
memory/3132-5-0x0000000074F80000-0x0000000075730000-memory.dmpFilesize
7.7MB
-
memory/3132-6-0x0000000005960000-0x0000000005970000-memory.dmpFilesize
64KB
-
memory/3132-7-0x0000000007CF0000-0x0000000007D56000-memory.dmpFilesize
408KB
-
memory/3132-0-0x0000000074F80000-0x0000000075730000-memory.dmpFilesize
7.7MB
-
memory/3132-3-0x00000000082A0000-0x0000000008844000-memory.dmpFilesize
5.6MB
-
memory/3132-10-0x0000000008F70000-0x0000000008FAC000-memory.dmpFilesize
240KB
-
memory/3132-2-0x0000000005720000-0x000000000576C000-memory.dmpFilesize
304KB
-
memory/3132-1-0x0000000000D80000-0x0000000000DAE000-memory.dmpFilesize
184KB
-
memory/3132-18-0x0000000074F80000-0x0000000075730000-memory.dmpFilesize
7.7MB
-
memory/3148-16-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/3148-20-0x0000000008F60000-0x0000000008F6A000-memory.dmpFilesize
40KB
-
memory/3148-15-0x0000000074F80000-0x0000000075730000-memory.dmpFilesize
7.7MB