Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 14:15
Behavioral task
behavioral1
Sample
ModFixer.exe
Resource
win7-20240221-en
General
-
Target
ModFixer.exe
-
Size
3.1MB
-
MD5
dbe30fa7971e0fa7ac8dc6e99af93f1b
-
SHA1
d92f550a0286af3b7485d0e21d0974c7c59fe5e9
-
SHA256
801d4bbd5bdd9780c9cfb969b61adb16fe20709798a01880fa8cdaf61a56f6d4
-
SHA512
739e9429dc5c4f1ad118495600697778d5246965de9200666bd6c3d947fd34a77f5e3fd669033e370e82dd83d821e9ae9ee8d8d3d93ab28780c21fdbb97efb25
-
SSDEEP
49152:/vKz92YpaQI6oPZlhP3ReybewoLGRJ6jbR3LoGdF8THHB72eh2NT:/v492YpaQI6oPZlhP3YybewoLGRJ6V1
Malware Config
Extracted
quasar
1.4.1
Slave
uk2.localto.net:37735
192.168.1.54:443
192.168.1.54:80
82.47.98.176:80
82.47.98.176:443
70129915-f2b5-40ef-aa85-96dbc3efa5c9
-
encryption_key
76B28C3E753D8BB017093D2AA2C736559D00B442
-
install_name
GorillaTag.exe
-
log_directory
Steam Error Logs
-
reconnect_delay
3000
-
startup_key
Steam WebHelper
-
subdirectory
SubDir
Signatures
-
Quasar payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3008-0-0x00000000003C0000-0x00000000006E4000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe family_quasar behavioral1/memory/2036-8-0x0000000000170000-0x0000000000494000-memory.dmp family_quasar -
Executes dropped EXE 1 IoCs
Processes:
GorillaTag.exepid process 2036 GorillaTag.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2636 schtasks.exe 2184 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ModFixer.exeGorillaTag.exedescription pid process Token: SeDebugPrivilege 3008 ModFixer.exe Token: SeDebugPrivilege 2036 GorillaTag.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
GorillaTag.exepid process 2036 GorillaTag.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
GorillaTag.exepid process 2036 GorillaTag.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
GorillaTag.exepid process 2036 GorillaTag.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ModFixer.exeGorillaTag.exedescription pid process target process PID 3008 wrote to memory of 2184 3008 ModFixer.exe schtasks.exe PID 3008 wrote to memory of 2184 3008 ModFixer.exe schtasks.exe PID 3008 wrote to memory of 2184 3008 ModFixer.exe schtasks.exe PID 3008 wrote to memory of 2036 3008 ModFixer.exe GorillaTag.exe PID 3008 wrote to memory of 2036 3008 ModFixer.exe GorillaTag.exe PID 3008 wrote to memory of 2036 3008 ModFixer.exe GorillaTag.exe PID 2036 wrote to memory of 2636 2036 GorillaTag.exe schtasks.exe PID 2036 wrote to memory of 2636 2036 GorillaTag.exe schtasks.exe PID 2036 wrote to memory of 2636 2036 GorillaTag.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ModFixer.exe"C:\Users\Admin\AppData\Local\Temp\ModFixer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Steam WebHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe"C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Steam WebHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\SubDir\GorillaTag.exeFilesize
3.1MB
MD5dbe30fa7971e0fa7ac8dc6e99af93f1b
SHA1d92f550a0286af3b7485d0e21d0974c7c59fe5e9
SHA256801d4bbd5bdd9780c9cfb969b61adb16fe20709798a01880fa8cdaf61a56f6d4
SHA512739e9429dc5c4f1ad118495600697778d5246965de9200666bd6c3d947fd34a77f5e3fd669033e370e82dd83d821e9ae9ee8d8d3d93ab28780c21fdbb97efb25
-
memory/2036-10-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmpFilesize
9.9MB
-
memory/2036-8-0x0000000000170000-0x0000000000494000-memory.dmpFilesize
3.1MB
-
memory/2036-11-0x000000001B190000-0x000000001B210000-memory.dmpFilesize
512KB
-
memory/2036-12-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmpFilesize
9.9MB
-
memory/2036-13-0x000000001B190000-0x000000001B210000-memory.dmpFilesize
512KB
-
memory/3008-0-0x00000000003C0000-0x00000000006E4000-memory.dmpFilesize
3.1MB
-
memory/3008-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmpFilesize
9.9MB
-
memory/3008-2-0x000000001B2A0000-0x000000001B320000-memory.dmpFilesize
512KB
-
memory/3008-9-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmpFilesize
9.9MB