Analysis
- max time kernel
45s - max time network
48s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
11/03/2024, 16:21
Behavioral task
behavioral1
Sample
Virtue Private.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
- Target Virtue Private.exe
- Size 3.1MB
- Sample240311-ttnrkabc62
- SHA256 28b1d8db8e3d8c6323d2c118519225ac31c5b35411de11da7a78a9b7a393a909
- MD5 36d82886e6adaa56b73175f130810403
- SHA1 e3e8ba3ce0ecb564ec02453a19d425e6b350efd7
- SHA512 eef6506bca24139f43092851fafb07279a1f06417ab4c023579c8a91bb2090f9a3920077dac3cffb1bb305eecd89ef8380d0dcab4ec4eed77274855f69ffe248
- SSDEEP 49152:KvVt62XlaSFNWPjljiFa2RoUYInpRJ6SbR3LoGdgGjTHHB72eh2NT:Kvn62XlaSFNWPjljiFXRoUYInpRJ6MH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
80.222.152.67:4782
Mutex
-
a6ae3668-7a90-4738-8db0-c5d5669c4b34
Attributes
-
encryption_key
FEBD1C7C69CED06E8B8B9F6EDE22C31EBEF8E212
-
install_name
Roblox.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Roblox
-
subdirectory
SubDir
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral2/memory/3724-0-0x0000000000160000-0x0000000000484000-memory.dmp family_quasar behavioral2/files/0x000a000000023189-5.dat family_quasar - Executes dropped EXE 1 IoCs
pid Process 512 Roblox.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\SubDir\Roblox.exe Virtue Private.exe File opened for modification C:\Windows\system32\SubDir\Roblox.exe Virtue Private.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 888 schtasks.exe 4592 schtasks.exe - Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3724 Virtue Private.exe Token: SeDebugPrivilege 512 Roblox.exe Token: SeDebugPrivilege 2056 taskmgr.exe Token: SeSystemProfilePrivilege 2056 taskmgr.exe Token: SeCreateGlobalPrivilege 2056 taskmgr.exe - Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 512 Roblox.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe - Suspicious use of SendNotifyMessage 52 IoCs
pid Process 512 Roblox.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe 2056 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 512 Roblox.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3724 wrote to memory of 888 3724 Virtue Private.exe 91 PID 3724 wrote to memory of 888 3724 Virtue Private.exe 91 PID 3724 wrote to memory of 512 3724 Virtue Private.exe 93 PID 3724 wrote to memory of 512 3724 Virtue Private.exe 93 PID 512 wrote to memory of 4592 512 Roblox.exe 94 PID 512 wrote to memory of 4592 512 Roblox.exe 94 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Virtue Private.exe"C:\Users\Admin\AppData\Local\Temp\Virtue Private.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Roblox" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Roblox.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
PID:888
-
-
C:\Windows\system32\SubDir\Roblox.exe"C:\Windows\system32\SubDir\Roblox.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Roblox" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Roblox.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4592
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\SubDir\Roblox.exe
- Size 3.1MB
- SHA256 28b1d8db8e3d8c6323d2c118519225ac31c5b35411de11da7a78a9b7a393a909
- MD5 36d82886e6adaa56b73175f130810403
- SHA1 e3e8ba3ce0ecb564ec02453a19d425e6b350efd7
- SHA512 eef6506bca24139f43092851fafb07279a1f06417ab4c023579c8a91bb2090f9a3920077dac3cffb1bb305eecd89ef8380d0dcab4ec4eed77274855f69ffe248
- SSDEEP 49152:KvVt62XlaSFNWPjljiFa2RoUYInpRJ6SbR3LoGdgGjTHHB72eh2NT:Kvn62XlaSFNWPjljiFXRoUYInpRJ6MH
- MD5 SHA1 SHA512 SSDEEP